text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants.

companyName: Vestand Inc.

ticker: VSTD


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any instances of material cybersecurity incidents that impacted the Company in the last three years. However, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A. Risk Factors – The occurrence of cyber incidents, or a deficiency in our Advisor's cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results.

companyName: Net Lease Office Properties

ticker: NLOP

secItem: Item 1C


text: T. Rowe Price maintains documented Enterprise Incident Management and Reporting Policies and Procedures, outlining responsibilities and requirements for escalation of various types of incidents, including cybersecurity threats and incidents. Our process is designed to investigate incidents efficiently, identify root cause, communicate with the affected parties as appropriate, spot trends, and recommend improvements to mitigate risk. These procedures incorporate incident materiality determination within senior executive levels and operate firm-wide.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: The Engineering Risk Steering Group oversees Engineering risk decisions, monitors control performance and reviews approaches to comply with current and emerging regulation applicable to Engineering. This committee is chaired by the CISO (who also serves on the Firmwide Technology Risk Committee) and reports to the Firmwide Technology Risk Committee.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Federated Hermes' Enterprise-Wide Risk Management Committee (ERC), which is chaired by Federated Hermes' CRO, oversees Federated Hermes' company-wide enterprise risk management program. The ERC includes department heads from across Federated Hermes and implements the processes established to identify, report and monitor material risks facing the Company, including cybersecurity risks.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: The Company maintains an Incident Response Plan that includes processes for detecting, containing, and responding to incidents including processes for reporting incidents to management and the Board of Directors. The Company periodically performs simulations and tabletop exercises at a management level and incorporates external advisors as needed. The Company engages third-party service providers to conduct evaluations of its security controls, whether through penetration testing, independent audits or consulting on best practices to address cybersecurity risks.

companyName: OSHKOSH CORP

ticker: OSK


text: Cybersecurity incidents are regularly reported to cross-functional teams at each subsidiary through the dedicated means we have in place, and events deemed critical are reported to the Chief Executive Officer and Chief Financial Officer. Moreover, the audit committee and the board of directors are promptly informed of any significant cybersecurity incident, along with continuous updates until resolution.

companyName: ARGAN INC

ticker: AGX


text: We also manage cybersecurity risk by limiting our threat landscape. For example, as an omni-channel retailer, we accept credit and debit cards via all sales channels and protecting cardholder data is a critical component of our security practices. Accordingly, PCI compliance (discussed briefly above) is very important and we engage an external qualified assessor to audit our compliance and to provide us with a report on compliance that is also shared with various payment providers. To help reduce our exposure to unauthorized access of cardholder data, we have utilized a strategy of minimizing or eliminating the storage of, and unencrypted transmission of, cardholder information across our various systems.

companyName: Zumiez Inc

ticker: ZUMZ


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We also perform formal risk assessment activities annually, aligned to the National Institute of Standards and Technology (NIST) 800-171 and Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information security professionals monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.

companyName: Avantor, Inc.

ticker: AVTR


text: We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Our security technology team, led by the Head of Core Technology & Security ("Head of CT&S"), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: Our Chief Financial Officer provides briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In addition, our Chief Financial Officer provides briefings of any significant cybersecurity matters to the Board as well as an annual update of cybersecurity risks and activities.

companyName: Allakos Inc.


text: In the event of an incident, our Incident Response Plan, which takes into account the perceived materiality of the incident with an appropriate escalation matrix, guides our response. Incident reports are compiled, reviewed by management, and shared with the CIO, CFO, the Audit Committee, and other key leaders, as appropriate, for resource allocation and risk mitigation planning.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our Global Security Organization is responsible for the day-to-day execution of our cyber risk management strategy. This strategy has been incorporated into our overall ERM program and is thus informed by, and overseen through, our ERM program. Our ERM program facilitates identifying, prioritizing, analyzing and remediating enterprise risks, in which cyber risks are included. Within the broader ERM framework, we established a specific program - the IRM program - organizing the governance of risks associated with information held by us. The IRM Steering Committee, of which our CSO is a member, manages the IRM program, discusses the management of cyber risks on a regular cadence and substantive updates from the IRM Steering Committee are provided to the ERM Steering Committee. Finally, through our ERM program, updates and discussion regarding our cybersecurity risk management are provided to and occur at the Risk Committee of our Board of Directors.

companyName: TRINET GROUP, INC.

ticker: TNET


text: Our management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, Director of IT, and CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: GE HealthCare employs practices, processes, and procedures to proactively and comprehensively manage risks, including risks related to cybersecurity, through its enterprise risk management ("ERM") program. We aim to identify material cybersecurity risks via multiple strategies, including user and external reporting, audit and assessment activities, and technology programs. We utilize risk identification and risk mitigation strategies.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Our cybersecurity program evaluation identified various risks and issues that we continue to mitigate to further improve our program. This includes: • Establishing a cybersecurity training program for users. • Implementing a third-party risk management program to support our existing Third-Party Risk Management Policy and process to assess the risks associated with our critical third-party vendor engagements. • Testing our Cybersecurity Incident Response Plan. • Establishing additional processes for identifying cybersecurity threats and vulnerabilities within the environment in which we operate. • Enhancing our technical security management safeguards and configurations.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Audit Committee receives quarterly updates from the Chief Information Officer ("CIO") on significant risks, cyber incidents, key performance indicators measuring the effectiveness of our cybersecurity risk program, and other relevant matters. The Audit Committee regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Audit Committee and the Board. In addition to the regular updates to the Audit Committee, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, and tabletop exercises. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our customers) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of customers and adversely affect our business and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: WideOpenWest, Inc.

ticker: WOW


text: The GIS Program is led by CME Group's Chief Information Security Officer (CISO), who has worked in various roles in information security for over 20 years, and has led our GIS Program for more than four years since joining the company in 2016 in a senior role in GIS. The CISO reports to our Chief Information Officer (CIO), a member of our Management Team. Our GIS team is comprised of over 200 full-time employees, many of which hold cybersecurity, risk, or management certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Series 99, Certified Information Systems Auditor, Project Management Professional, various cloud provider certifications and various levels of ITIL certifications. As part of our GIS Program, CME Group operates a state-of-the-art Cyber Defense Center that virtually links 24/7 to our international operational cybersecurity teams and serves as a global hub for cybersecurity risk management activities, including log collection, event monitoring, threat detection and incident response, resiliency, operations, vulnerability management and the proactive collection and processing of both open source and proprietary threat and intelligence feeds allowing the company to efficiently manage, investigate and respond to cybersecurity events. Our GIS team conducts analyses and aims to prevent, detect and respond to systemic events that might threaten our company, industry or the economy.

companyName: CME GROUP INC.

ticker: CME


text: The Managing Owner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.

companyName: GLOBAL MACRO TRUST


text: We also have data privacy and cybersecurity focused training for our shoreside and select shipboard team members. We regularly educate our shoreside and shipboard team members about the importance of handling and protecting guest and team member data, including phishing simulation exercises and annual privacy and security training to enhance awareness of how to detect and respond to cybersecurity threats.

companyName: CARNIVAL PLC

ticker: CUK


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third - party information and employee information.

companyName: SEELOS THERAPEUTICS, INC.


text: The work done by each of these divisions is applied both tactically and strategically to operations, as well as to broader risk management activities.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Our Board is responsible for the overall oversight of our enterprise risk management. The Board receives regular updates on the key risks to the organization on a quarterly basis. The Board has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives quarterly cybersecurity updates from the Company's Chief Information Security Officer (CISO), which includes updates on the Company's cybersecurity policies and strategies, cyber risks and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: 8x8 conducts thorough assessments to determine the potential impact and materiality of cybersecurity incidents. 8x8's Chief Information Security Officer is a member of 8x8's internal disclosure committee emphasizing the importance of cybersecurity as part of 8x8's disclosure controls and procedures. By evaluating factors such as the nature of the incident, the extent of data exposure, and potential regulatory implications, the Company assesses the significance of cybersecurity events, which helps it take appropriate measures to mitigate risks, minimize impact and properly report any material cybersecurity incidents.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We employ a number of protective measures, including firewalls, endpoint detection and response technologies, regular annual training of employees with respect to cybersecurity and testing employee competence with anti-phishing policies followed up by additional remedial training as needed.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Our Board, in coordination with our Audit Committee, oversees our management of cybersecurity risk, with the Audit Committee reviewing and discussing with management quarterly matters related to our Cybersecurity Program as related to financial reporting. The Board and Audit Committee receive periodic reports about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into the Company's enterprise risk management assessment and reported to our Board at least twice per year. We also share the key results of third-party assessments with our Board and Audit Committee.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: On a quarterly basis, our employees, contractors, and other users of the Company's systems and networks are required to take cybersecurity training. The training is designed to provide employees and contractors with a baseline understanding of cybersecurity fundamentals to prevent security breaches and safely identify potential threats. These trainings are administered through a collaboration with third-party services and systems and address various topics, including how to handle sensitive and personal information, physical security of intellectual property, how to identify phishing attempts, reducing our risk to being phished and how to improve cybersecurity intelligence while working from home.

companyName: Ecovyst Inc.

ticker: ECVT


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this annual report, we are not aware of any cybersecurity incidents that have had a material impact on our business. However, like many companies, we continue to face ongoing cyber threats, including phishing and other unauthorized access attempts, which if successful could have a material impact in the future. For more information, see "Risks related to information security and technology" included in Item 1A. Risk Factors of this annual report.

companyName: lululemon athletica inc.

ticker: LULU


text: Mr. Downing is supported by Mr. Carlson, our Director of Cybersecurity and Compliance, and his team. Mr. Carlson has 24 years of experience in information technology focused on highly regulated sectors including energy, government, and insurance. He holds a bachelor's degree in Information Technology, and master's degrees in Information Assurance and Business Administration. The remainder of our team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity, threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Collectively our team has certifications from various organizations such as American Society for Industrial Security, AXELOS, Cloud Security Alliance, Information Systems Audit and Control Association, International Information System Security Certification Consortium and SANS Institute.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Officer, who reports directly to our Chief Financial Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: As part of its oversight of management's implementation and maintenance of the Bank's risk management framework, the Bank's Board of Directors receives regular updates directly from both IT and Audit Committees concerning cybersecurity matters. These updates generally include information regarding cybersecurity and technology developments, the Bank's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Bank's efforts to address those incidents.

companyName: RBB Bancorp

ticker: RBB


text: The board of managers' oversight of cybersecurity risk management is supported by the Company's Incident Response Team (the "IRT"), which is made up of the Company's Co-Chief Information Officers, the Chief Operating Officer, and their designees. The IRT regularly interacts with the board of managers and members of management.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: As of May 31, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Londax Corp.

ticker: LDXC


text: We also created and maintained processes that provided a playbook in the event of a cyber incident. These processes provided assessment and response tools designed to mitigate damage from attacks and integrate third-party digital forensics, legal providers and law enforcement as part of the response plan. We also instituted a variety of safeguards to counter ransomware threats.

companyName: EQC Liquidating Trust


text: operations or financial condition in the future. See "Risks Related to Information Technology, Cybersecurity and Privacy" in Item 1A, "Risk Factors" of this 2024 Annual Report.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Risk Assessment. Our in-house security teams and third-party security firms periodically evaluate the Company's cybersecurity policies, processes, and practices. Such evaluations may include audits, assessments, penetration testing, threat modeling, tabletop exercises, and similar activities focused on evaluating the effectiveness of our cybersecurity processes and planning. The Company updates its cybersecurity policies, standards, processes, and practices periodically, as appropriate, based on the insights gained from these assessments, evolving industry standards, cybersecurity threat intelligence, changes to our infrastructure, and client-specific requirements.

companyName: IBEX Ltd

ticker: IBEX


text: We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements and examine the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing, incident response exercises, maturity assessments, and industry benchmarking. We also dedicate significant resources that are designed to secure our systems and to protect confidential information, such as firewalls, endpoint protection, and behavior analysis tools, among others, and engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. In addition, we annually perform a risk assessment of our third-party service providers.

companyName: AUTONATION, INC.

ticker: AN


text: The Company maintains an enterprise-wide and Board-approved Information and Cyber Security Program (the "Program"), which includes strategy, written policies, procedures, guidelines and standards to address the assessment, identification and management of cybersecurity risks. The Company designed the Program to be consistent with industry standards and in compliance with applicable federal and New York state laws, regulations and guidelines. As discussed in further detail under the subheading "Governance" below, the Program is fully integrated with the Company's overall enterprise risk management systems and processes.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: A dedicated team of technology professionals monitors and manages cybersecurity risks. They are led by our Chief Technology Officer (CTO), who has significant experience in senior leadership positions with responsibility for cybersecurity and IT risk management, and our Chief Information Security Officer (CISO), who is a Certified Information Systems Security Professional (CISSP). Their teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CTO and CISO regularly engage with our Chief Administrative Officer. They also report monthly on cybersecurity matters to our entire executive management team.

companyName: Public Storage

ticker: PSA


text: As a general matter, our CDO is responsible for defining our entire cybersecurity posture. The CDO has oversight in planning the strategy, programs, policies and procedures to protect the organization's digital assets, information and infrastructure. Our IT Director, Cyber Security serves as the CIMT's Incident Manager and is the member of management primarily responsible for assessing, identifying, mitigating and managing cybersecurity risks; supervising IT security design, development, implementation and testing; and running the day-to-day operations of our cybersecurity team. Our CDO holds a bachelor's degree in electronics and telecommunications engineering and has more than 35 years of information technology and cybersecurity experience in various leadership and executive roles. In addition, our IT Director, Cyber Security holds a bachelor's degree in computer information systems and the Certified Information Systems Security Professional (CISSP) and Information Systems Security Architecture Professional (ISSAP) certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: We have implemented a systematic approach to managing our cybersecurity risks and have adopted a comprehensive set of cybersecurity policies that include best practices based on recognized industry standards and guidelines. These policies provide guidance on roles and responsibilities of key stakeholders and promote awareness. These policies also cover cyber education and training as well as help us to align with applicable laws and regulations to meet our compliance requirements. The primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Security Officer (CISO) within our GIS organization, who reports to our Chief Technology Officer. The CISO is also responsible for managing the risk assessment and mitigation process. Our CISO has over 10 years of experience serving in various roles in risk management as well as enterprise and cybersecurity, including serving as the project lead and founder of the Open Worldwide Application Security Project (OWASP) flagship project Security Shepherd, a web and mobile application security training program, and leading IBM's ethical hacking team. He was also a principal security engineer at Axway prior to joining Synchronoss where he served as product security architect and a director of product security prior to accepting the role as our CISO. Our Chief Technology Officer has over 20 years of experience in the telecommunications industry, including serving as our Chief Architect and Senior Software Engineer, during which he oversaw our GIS program, including the governance, risk and compliance management related thereto. We also engage consultants, and other service providers, to help us implement our cybersecurity policies and procedures. These service providers assist us with monitoring security threats and vulnerabilities as well as responding to identified cybersecurity incidents, including prompt escalation and timely communication of major security incidents to senior business leadership and the Audit Committee.

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: We engage a third-party to provide operational support for cybersecurity risks. This forms a critical part of our risk management strategy, facilitating effective management and mitigation of risks, and ensuring adherence to applicable regulatory and industry standards.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: NEE's chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats, including those related to NEP, and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including NEP's chief financial officer, general counsel, and president and the Cybersecurity Governance Executive Committee comprised of various members of management, including NEE's vice president of internal audit and executive director of emergency preparedness. These NEE committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries as well as NEP.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Our cybersecurity program, which is discussed in greater detail under the "Risk Management and Strategy" heading above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: While we and our third-party providers have in the past experienced cybersecurity incidents, we are not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register. Also, the security team works with management to help identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program, including, for example, professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.

companyName: Sprout Social, Inc.

ticker: SPT


text: The Company relies on Ashford Inc and the Company's managers to protect the electronic assets of the Company. Their programs consist of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, electronic communication, risk/security reporting, incident response planning and business continuity planning. The information technology department of Remington Hospitality ("IT Department"), which includes a cybersecurity department ("IT Security Department"), is responsible for implementing processes and coordinating with the Human Resources Department to align training and onboarding efforts of Ashford Inc. and Remington Hospitality employees handling the Company's electronic assets.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: To further strengthen our cybersecurity risk management framework, we have instituted an Information Security Management System ("ISMS") that equips us with advanced risk management capabilities. This system facilitates the development of a detailed risk registry, incorporating impact and likelihood scoring to prioritize risks effectively. Additionally, it guides the creation of comprehensive risk treatment plans and sets targets for residual risk, ensuring a strategic approach to risk mitigation. A key feature of our ISMS is a risk management insights dashboard, which provides real-time visibility into the current state of risk within our environment. This dashboard is an invaluable tool for our management and key stakeholders, enabling them to track risk exposure and trends accurately. Quarterly reviews are scheduled, during which key stakeholders convene to scrutinize and adjust risk treatment plans in response to the latest threat landscape. This process underscores our commitment to a dynamic and responsive cybersecurity risk management strategy, ensuring the ongoing protection of our systems, data, and operations against emerging threats.

companyName: TRANSCAT INC

ticker: TRNS


text: The Company's Board of Directors ("Board") recognizes the critical importance of maintaining the trust and confidence of our employees, customers, shareholders and other stakeholders. Among other areas of responsibility, the Board has oversight responsibilities in relation to the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies and practices are integrated into the Company's ERM program and our risk goals are guided by internationally recognized standards and frameworks that help us to identify, assess, and manage risks relevant to our business. In general, the Company manages our cybersecurity risk using an evidence- and risk-based approach designed to reduce risks and thereby protect the Company's mission, business, and stakeholders, rather than focusing upon meeting any specific technical specifications.

companyName: GATX CORP

ticker: GATX


text: At the day-to-day operational level, Lumen maintains an experienced information security team who are tasked with implementing our privacy and cybersecurity program and support the CSO in implementing our detection, reporting, security and mitigation functions. This team and the CSO work to develop and implement tools and processes designed to assist in identifying, containing and remediating cybersecurity incidents, and periodically retain consultants to assist with these activities. Lumen also periodically holds employee trainings on our privacy, cybersecurity and information management policies, conduct phishing tests and generally seek to promote a company-wide awareness of cybersecurity risk through broad-based communications and educational initiatives.

companyName: QWEST CORP

ticker: CTBB


text: Our cybersecurity risk management program is centered on the following principles: • Risk-based approach to managing controls, cost benefit and control effectiveness; • Defense-in-depth approach with the assumption of breach mindset; • Resiliency to mitigate, manage and recover from incidents or disasters; • Zero-trust architecture with services well secured and networks be untrusted; and • Least privilege identity and access management.

companyName: SSR MINING INC.

ticker: SSRM


text: Our cybersecurity risk management program includes: • processes designed to help identify, assess and manage material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity incident response team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, cybersecurity program; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process for service providers, suppliers, vendors and others in our supply chain.

companyName: Gritstone bio, Inc.


text: Our CIO regularly updates senior management on our cybersecurity risk governance and management and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our board of directors views cybersecurity as a strategic priority and therefore maintains oversight of management's actions in implementing our overall cybersecurity program, with our CIO regularly reporting directly to our board of directors. The audit committee of the board of directors also periodically reviews the cybersecurity program as part of its oversight of the Company's internal audit function and insurance program.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: In recent years, cyberattacks, including denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing) and other tactics designed to gain access to and exploit sensitive information by breaching mission critical systems of large organizations have increased in volume and sophistication. RWT's information technology systems and automated machinery, which it will rely on to operate its business, could be exposed to such tactics. RWT may also experience unavailable systems, unauthorized access or disclosure due to employee theft or misuse, sophisticated nation-state and nation-state supported actors and advanced persistent threat intrusions.

companyName: Rain Enhancement Technologies Holdco, Inc.

ticker: RAIN


text: The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors. The CISO provides periodic updates to the Audit Committee, the full Board of Directors (the " Board "), our Chief Executive Officer, and other members of senior management, as appropriate. These updates typically address: • Evolving cyber risks and threats; • Progress on strategic initiatives to safeguard our information systems; • Cyber incident response preparedness and capabilities; • Findings from assessments of our information security program; and • Insights into the emerging threat landscape.

companyName: NEOGENOMICS INC

ticker: NEO


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's CISO. As of December 31, 2023, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions. He also holds the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.

companyName: BlackRock Finance, Inc.


text: As previously disclosed in a Form 8-K filed on October 16, 2024, on October 9, 2024 we identified a cybersecurity incident, which involved unauthorized activity within some of our systems. We immediately activated the Company's Cyber Incident Response Plan ("IRP") to investigate such activity with the assistance of leading third-party cybersecurity experts. We also notified law enforcement authorities. We continue to monitor the situation and take appropriate actions consistent with our response protocols. As of the date of this filing, the incident has not caused, and is not expected to cause, disruption of the Company's business operations. And although there can be no assurance, we do not believe the identified cybersecurity incident will have a material effect on our business, financial condition, results of operations or cash flows.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Oversight and Governance Our Chief Compliance Officer and the Chief Financial Officer lead the oversight of company-wide cybersecurity strategy, policy, standards and processes. We utilize third-party IT consultants to help manage cybersecurity risks. Our Chief Compliance Officer and Chief Financial Officer have the requisite experience in risk assessment and a strong understanding of business operations, including experience with security frameworks, compliance regulations, and the ability to communicate effectively with both technical and non-technical stakeholders. Our consultants have the requisite combination of technical experience in network security, system administration, and incident response.

companyName: NextPlat Corp

ticker: NXPL


text: conduct mandatory annual phishing training and regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; utilize pseudonymized data for patients and use other encryption methods to ensure security of personal data;

companyName: Profound Medical Corp.

ticker: PROF


text: We recognize that cybersecurity threats are constantly evolving and have the potential to cause significant harm to our Company and our stakeholders. In order to address these risks, we have established a cybersecurity risk management framework that is aligned with industry best practices and regulatory requirements.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: Our information technology and cybersecurity team has approximately 35 years of collective experience in information security and cybersecurity strategy, with various roles in significant organizations. Team members' relevant degrees and certifications include but are not limited to Certified Information Security Manager, Certified Information Systems Security Professional, Certified Ethical Hacker, Certified Penetration Tester, among others.

companyName: ARTIVION, INC.

ticker: AORT


text: The Audit Committee receives updates from members of management on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity, risk mitigation status, and the current and emerging threat landscape. In addition, management provides updates to the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: Zeo Energy Corp.

ticker: ZEO


text: As discussed above, we maintain an IRP that guides our response to a cybersecurity incident. Annually, we test the IRP's response procedures, including through disaster response and business continuity plan exercises. These exercises are intended to challenge and validate our information security response and resources through simulated cybersecurity incidents, including engagement of outside cybersecurity legal counsel, other third-party partners, key internal personnel, executive management, and our Board.

companyName: Public Storage

ticker: PSA


text: Our ISO reports directly to our Senior Vice President, Chief Information Officer (CIO), who is a member of the committee. He has held this role at Dexcom since 2021, having previously served as our Senior Vice President, Information Technology since 2018 and Vice President, Information Technology from 2016 to 2018. Our CIO also has a wide range of experience within global organizations in the field of information technology, including having served in various IT leadership roles at CareFusion, a Becton Dickinson Company, from 2012 to 2016, and ResMed in San Diego from 2007 to 2012. He holds a Bachelor of Engineering in Mechanical Engineering and a Master of Industrial Engineering. Our PSO reports directly to our Executive Vice President, Chief Technology Officer (CTO), who is also a member of the committee. Our CTO has held this role since 2022 and has 25 years of experience spanning consumer electronics, data storage, IoT and broadband industries. From 2011 to 2022 he worked at Technicolor (now known as Vantiva), most recently serving as Chief Technology Officer and General Manager of the Broadband Business Division. In addition to an MBA, he holds a Master of Science in Mechanical Engineering and a Bachelor of Mechanical Engineering.

companyName: DEXCOM INC

ticker: DXCM


text: The Board has overall responsibility for the Company's enterprise risk management program, and the Audit and Risk Management Committee assists the Board with this oversight. The Company's internal audit function reports to the Audit and Risk Management Committee and, among other things, provides independent assurance on the Company's risk management activities and internal controls related to cybersecurity risk. For more information, see Part 3, Item 10 "Directors, Executive Officers and Corporate Governance – Enterprise Risk Management".

companyName: BLACKBERRY Ltd

ticker: BB


text: Third Party Service Provider Monitoring The Bank maintains a robust Vendor Management Program to appropriately measure, monitor and control risks associated with outsourcing products and services, including cybersecurity risks. Under the program, vendors are assigned a risk rating based on an assessment of the vendor and its access to network, systems and confidential information. The Bank's Information Security Officer conducts regular periodic reviews of the adequacy of its oversight of controls over third party relationships.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Our cybersecurity policies, processes and practices are informed by the cybersecurity framework established by the National Institute of Standards and Technology. We are able to leverage a cross-functional team that includes senior personnel from our technology, operations, legal, risk management and internal audit functions as and when warranted by the particular cybersecurity matter. In managing cybersecurity risks, we strive to: (i) identify, prevent and mitigate cybersecurity threats; (ii) preserve the confidentiality, security and availability of proprietary or confidential information; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our members, marketplace investors and business partners; and (v) provide appropriate and required disclosure of cybersecurity risks and incidents.

companyName: LendingClub Corp

ticker: LC


text: a defined procedure for timely incident detection, containment, response, and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents;

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: The Company maintains an ERM program with a governance structure that is designed to identify, assess, prioritize, and mitigate risks across the organization. The ERM Executive Committee, comprised of the Company's senior leadership team, has the ultimate responsibility for overseeing the identification of the key risks facing the Company and meets regularly to discuss the Company's approach to mitigating those risks. Through the ERM process, cybersecurity has been identified as an important risk facing the Company. As a result, the cybersecurity program is an important component of the Company's ERM processes. In addition to discussing the cybersecurity program at ERM Executive Committee meetings, members of the ERM Executive Committee participate in the cybersecurity incident response process. This process includes a governance model and procedures for identifying, categorizing, containing, and responding to cybersecurity incidents. As a component of the cybersecurity incident response process, the Company conducts attack simulations and exercises and has used third parties to support this work. The Company also maintains business continuity and disaster recovery plans to prepare for potential technology disruptions and to better position the Company to recover from any cybersecurity incident. The Company's Disclosure Committee also includes a member of the ERM Executive Committee, helping to ensure timely analysis of disclosure obligations relating to cybersecurity events.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: Role of Management Through a services agreement between Qurate Retail and Liberty Media Corporation ("LMC"), Qurate Retail has established a cross functional Information Security Steering Committee ("ISSC") with executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at Qurate Retail and at QVC.

companyName: QVC INC

ticker: QVCD


text: Under our cybersecurity governance framework, our Board and our Risk Committee are primarily responsible for overseeing and governing the development, implementation and maintenance of our TRIS program, with the Board designating our Risk Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least once a year from our CISO or their designee. Our Risk Committee receives reports on cybersecurity at least twice a year, including in at least one joint meeting with our Audit and Compliance Committee, and our Board and these committees all receive ad hoc updates as needed. In addition, our Risk Committee annually approves our TRIS program.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes managing a security team and security tools, and as appropriate may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Lemonade, Inc.

ticker: LMND


text: Technical Safeguards and Continuous Monitoring As part of our cybersecurity program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. We utilize data analytics to detect anomalies and search for cyber threats. Our cybersecurity processes include a continuous monitoring system which supports comprehensive cyber threat detection and response capabilities and complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. Cyber partners are a key part of Holley's cybersecurity infrastructure. We partner with leading cybersecurity companies, leveraging third -party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in our environment.

companyName: Holley Inc.

ticker: HLLY


text: The information security organization, collectively, has extensive technology security and program management experience including cybersecurity professional certifications such as Certified Information Systems Security Professional ("CISSP"), advanced degrees in Information Assurance, and numerous years' experience assessing and managing cybersecurity risk within the Department of Defense and other public companies. Our CIO has over 25 years of technology experience, including leading information governance, I.T. security, and cybersecurity teams and initiatives across both publicly traded companies and global organizations.

companyName: Freshpet, Inc.

ticker: FRPT


text: As a result of the cybersecurity risk assessment performed, the Company has implemented certain enhancements to cybersecurity processes and controls. This includes formal monitoring of capital equipment, verifying data encryption and security updates are in place, and enhancing the security of data sharing and transmission. Additional recommendations were made by the consultants, but due to budget constraints they are being considered for future enhancement.

companyName: FORUM MARKETS Inc

ticker: FRMM


text: Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our information security team, internal governance processes, and by reviewing the results of internal and third-party assessments and audits. Our Chief Financial Officer regularly reports directly to the audit committee on our cybersecurity program and our efforts to prevent, detect, mitigate, and remediate cybersecurity risks.

companyName: Perception Capital Corp. IV


text: Our board of directors and executive leadership team, through our Information Security Executive Charter, oversees our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Our technology team, and particularly our information security team, are actively involved in the development and implementation of policies and tools to assess risk and identify emergent risks, with cross-functional support from enterprise risk management, legal, compliance and finance, among other teams. We have established governance structures to increase the maturity of our cybersecurity program with a governance, risk and compliance approach. This includes the identification of internal weaknesses and the mitigation of IT risks through training programs or new policies and internal controls.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks, for execution by our information security team, in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to test our response processes and incident management procedures.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: Our current Cyber Information Security Officer has a comprehensive information technology background with over 20 years of experience in managing or assisting in managing cybersecurity risks.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: We are currently in the process of integrating P3 into our CRMP and IRPs processes for BN. We expect such integration to be completed during fiscal 2026.

companyName: GRAHAM CORP

ticker: GHM


text: The Board receives regular updates from the CISO and Director of Risk Management regarding cybersecurity threats and program enhancements. In evaluating its oversight capabilities, the Board considers relevant cybersecurity expertise among its members and provides ongoing training where appropriate.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We do not believe our business strategy, results of operations or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: BOX INC

ticker: BOX


text: We maintain processes for escalation from each line, including processes to report information to management, management-level committees and to committees of the Board and the Board as a whole, as appropriate. For example, Risk Appetite Statements, top risks, and issues are reported to the Management Committees and the Risk Committee of the Board to monitor progress, identify trends, and escalate issues.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: J.P. Morgan's board of directors oversees the Information Security Program (the "Program") and a robust governance structure is designed to monitor, report, and escalate the status of information and cybersecurity risks. This structure uses key governance forums to disseminate management information and monitor Program efforts including through the use of key metrics. Established at multiple levels throughout J.P. Morgan, these forums include representatives from each line of business and relevant corporate functions including independent risk management and internal audit. The audit committee of J.P. Morgan's board of directors reviews and approves the Program.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We regularly identify and assess cybersecurity risks through a comprehensive program that includes: • Vulnerability assessments and penetration testing: We conduct regular vulnerability assessments and penetration testing to identify and address weaknesses in our systems and networks. • Threat intelligence: We subscribe to threat intelligence feeds and maintain relationships with security partners to stay informed about emerging cyber threats. • Third-party risk assessments: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties to assist us in identifying, assessing and managing cybersecurity risks. We conduct initial and regular due diligence on third-party vendors who handle our data and systems. • Business impact analysis: We regularly assess the potential impact of cyberattacks on our business operations and financial stability. • Legal and regulatory risk assessment: We assess the legal and regulatory risks associated with cybersecurity incidents and ensure compliance with applicable laws and regulations.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Information Security Officer ("ISO") and the Cybersecurity Incident Response Team ("IRT") are responsible for assessing and managing cybersecurity risks. The IRT is comprised of individuals with expertise in information security, technology, legal and risk management. The IRT monitors cybersecurity incidents and potential threats. It liaises with external cybersecurity experts and industry partners to stay current on emerging threats and best practices. The diverse expertise of the IRT members enables comprehensive risk assessment and swift responses to mitigate the potential impact of breaches or other cybersecurity incidents.

companyName: Strawberry Fields REIT, Inc.

ticker: STRW


text: As we have increased our remote workforce in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency. As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions. We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for our company.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: As of July 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: Rise Gold Corp.

ticker: RYES


text: The board of directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks.

companyName: iPower Inc.

ticker: IPW


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging people, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: The Company relies on our internal Technology Solutions team and third-party vendors to provide effective and efficient service to our customers, process claims and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information. We monitor the risks presented by the possibility of cybersecurity breaches of any of these systems. Accordingly, we have significantly invested, and will continue to invest, in technology security initiatives, information technology policies and resources, and teammate training to mitigate the risk of improper access to private information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. The Company's Enterprise Risk Management program and team plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the implementation of a holistic risk management program for overseeing the assessment and appropriate control of information and cybersecurity risks. Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of the Bank's risk appetite and security testing expectations. Risks identified are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal remediation activities that are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level Identification of risks is a multifaceted process, encompassing diverse activities such as the execution of formal risk assessments, as described above, management self-disclosures, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third party service providers/vendors. The dedicated Technology Risk Management team operates a continuous risk management framework, utilizing information gathered daily, weekly, monthly, quarterly and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities are performed internally and are outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: In 2022, the Board appointed Jason Sondhi to its Board of Directors. Mr. Sondhi has experience managing companies who provide endpoint detection and incident response, vulnerability scans, security information and event management, security employee training and vCISO services. Mr. Sondhi's cybersecurity expertise assists the Board in overseeing management's cybersecurity related efforts. PART I: ITEM 2., ITEM 3. AND ITEM 4.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Under the direction of our Senior Vice President, Information Technology and our Senior Director, Information Security (together, the "Cybersecurity Leadership Team") our Information Technology department regularly monitors cybersecurity threats and leads the prevention, detection, mitigation and remediation of cybersecurity incidents, with regular reporting to senior management and to the Board on these topics.

companyName: CubeSmart

ticker: CUBE


text: Cybersecurity and risks associated with information security are operational risks included in the Company's ERM Framework. Under the ERM Framework, the Company's Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company's ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with information security in accordance with our Risk Appetite Statement, as approved by the BOD.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Oversight of Third-Party Risk We have established processes to oversee and manage risks relating to third-party service providers. For example, our Security Operations Center, employs a Security Information and Event Management (SIEM) and other systems to monitor risks while also conducting thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Palladyne AI Corp.

ticker: PDYN


text: The Company has an IT Team and Cyber Incident Response Team made up of senior managers of the bank and led by the Chief Operating Officer (COO), the Information Security Officer (ISO) and the Security Officer (SO). The COO, ISO and SO, in conjunction with our third party cyber security technology provider, are primarily responsible for assessing and managing material risks from cybersecurity threats and are responsible for designing, implementing and maintaining our cybersecurity environment and incident response procedures. The ISO has twenty-eight (28) years of experience exclusively in the IT field. The IT Team is responsible for ensuring the Board of Directors and employees are trained annually on cybersecurity and information security awareness and apprised of any emerging threats. Additionally, the IT Team ensures employees are adequately trained on our incident response procedures.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. Senior leadership, including our CIO, briefs the Board of Directors and the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program as part of updates on our overall ERM program. Our Vice President of Internal Audit also provides the Audit Committee with an assessment of any material changes to cybersecurity risks and controls as a result of cybersecurity threats on at least a semi-annual basis.

companyName: Installed Building Products, Inc.

ticker: IBP


text: we utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, finance and other key business functions, as well as the members of the Board and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner; and the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Chief Financial Officer, Chief Accounting Officer, other members of management.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: For additional information on our cybersecurity risks, see Part I, Item 1A. "Risk Factors" under the section entitled "Cyberattacks or other network disruptions could have an adverse effect on our company and GCI's business" in this Annual Report on Form 10-K.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: We take a cross-departmental approach to addressing cybersecurity risk, which includes input from senior management, our Cybersecurity Council (a taskforce comprised of representatives from primary corporate functions across our Moving and Storage, Property and Casualty Insurance, and Life Insurance subsidiaries), other team members, and oversight by the Board and its Audit & Cyber Committee. We commit resources to cybersecurity and risk management processes to analyze the changing cybersecurity landscape and respond to ongoing and emerging threats. We monitor and assess the threat landscape on an ongoing basis. Our Cybersecurity Council reviews cybersecurity risks. In addition, we have a set of Company-wide policies and procedures that directly or indirectly relate to cybersecurity. These policies go through an internal review process and are approved by members of management.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; offsite backup storage of critical systems and information; Cadiz Inc. the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training;

companyName: CADIZ INC

ticker: CDZI


text: Our CISO along with our CIO typically provide quarterly briefings to the Audit Committee regarding our company's cybersecurity risks and activities, including recent cybersecurity incidents and strategy development. The findings from our annual enterprise risk assessment are also presented to the Audit Committee by our internal audit team. Our Audit Committee provides regular updates to the Board of Directors on such reports. In addition, our CISO along with our CIO typically provide annual briefings directly to the Board of Directors on cybersecurity risks and activities.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: The Chief Operations Officer ("COO"), who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The COO uses both internal and external resources to execute this process including security tools that help prevent, identify, escalate, investigate and resolve security incidents in a timely manner and tools that help prevent unauthorized access. The Company, with the oversight of the COO, also requires all employees to complete an annual cybersecurity training course.

companyName: Ascent Solar Technologies, Inc.

ticker: ASTI


text: In addition, we maintain an information security policy that covers safeguarding and managing confidential information, handling personal and company-sensitive data, managing access on/off-boarding and user accounts, acceptable use and IT change management to help govern the processes put in place by management designed to protect Skye's IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We and our cybersecurity partners maintain an IT assets inventory, identity access management controls including restricted access of privileged accounts, physical security measures at Company facilities, information protection/detection systems including maintenance of firewalls and anti-malware tools, network and data traffic monitoring and automated alerting, capacity management, industry-standard encryption protocols, formalized change management processes, critical data backups infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Incident Response Plan We have adopted an Incident Response Plan to provide a formal framework for responding to cybersecurity incidents. The overall purpose of the framework is to provide procedures designed to protect and preserve the availability, integrity and confidentiality of the Company's information and network assets, regardless of format. The plan was designed with the objective of performing timely investigations and assessments of the severity of the incidents (including the sensitivity of the information compromised), taking all appropriate measures to contain and control damage to customers resulting from the incident, returning to normal operating conditions as quickly as possible, and taking appropriate steps to comply with our legal and regulatory obligations, including our disclosure obligations under the securities laws.

companyName: Evercore Inc.

ticker: EVR


text: Internal Cybersecurity Team Our Incident Management Team (IMT) is led by our SRC Director, who serves as the point of contact for all IT security related matters within our company, and also includes our Chief Information Officer. Our IMT is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across our company. Our SRC Director is responsible for ensuring the regular review and maintenance of the Computer Security Incident Response Plan (CSIRP) and the execution of all procedures within it. Our SRC Director has technical leadership experience and cybersecurity expertise gained from over 25 years of experience, including security leadership, program development, strategy formulation, data protection, and IT risk management within the health care, pharmaceutical, and biotechnology industries. Our Chief Information Officer has nearly ten years of experience with our company, and an extensive background in security technology and operations, compliance, data privacy, business continuity, and disaster recovery.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: The Senior Vice President of Information Technology receives reports on information security and cybersecurity threats from our Director of Infrastructure and Cybersecurity and in conjunction with management, regularly reviews risk management measures implemented by our company to identify and mitigate information security and cybersecurity risks. A number of experienced information security team members responsible for various parts of the business also report to the Senior Vice President of Information Technology on an ongoing basis. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: We leverage a third party service provider under the direction of our Chief Financial Officer, or CFO, to help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: At least annually, ACRES' third-party cybersecurity compliance consultant conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents. We also periodically perform simulations and tabletop exercises. All employees are required to complete training that includes various topics on cybersecurity risk management best practices. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: Our audit committee is responsible for overseeing our cybersecurity risk management program. Our Director of Information Technology and/or Chief Financial Officer periodically update the audit committee on cybersecurity risks and mitigation strategies and related cyber matters. In the event of a cybersecurity incident, we have implemented processes for the Director of Information Technology and/or the Chief Financial Officer to discuss incident response strategies with the audit committee. The Director of Information Technology and/or the audit committee update the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.

companyName: Societal CDMO, Inc.


text: Our policy is to conduct an annual cybersecurity assessment and make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews. For the year ended December 31, 2024, the findings of our annual cybersecurity assessment indicated that HCW Biologics has implemented several key security measures, including documented policies, data encryption, unique user identifiers, DNS filtering, and anti-malware tools. We are in the proactive range for compliance with SEC cybersecurity guidelines, that is, we can address common attacks and current threats.

companyName: HCW Biologics Inc.

ticker: HCWB


text: The Director of Information Technology is responsible for assessing, monitoring, and managing the Company's cybersecurity risks. The Director of Information Technology has extensive experience in leading the Company's information systems and has previously led cybersecurity teams for several large global organizations prior to joining the Company.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our Chief Financial Officer and Senior Director, Information Technology provide periodic briefings to the audit committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or our manager, our transfer agent or any other party that provides us with essential services experiences cyber incidents."

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: The ISMS also provides for ongoing processes, tools and methods to bolster our cybersecurity defenses. We provide training to all of our employees, which includes annual information security awareness education, delivery of monthly cybersecurity updates, and simulated phishing exercises. We also host a live, third-party tabletop exercise annually for information security incident response for key individuals, including senior management and other senior leaders of the Company. Additional security features that we have in place that are intended to protect our systems and data from cyber-attacks include: physical and digital access controls, multifactor authentication for domain sign-on, corporate mobile device management, and tools to detect malicious emails and other suspicious activity.

companyName: Bumble Inc.

ticker: BMBL


text: The company's worldwide team of cybersecurity professionals undertakes a range of preemptive activities to protect its people, assets and reputation globally. The company also leverages internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. The company seeks to remove exploitable weaknesses in its systems or devices before they become a threat. Chevron security experts use automated threat intelligence feeds to increase vulnerability awareness, taking action to mitigate the highest risks. The company's cybersecurity guardrails, which are high-level design requirements expected to be built into any new digital solutions being deployed, are also updated on an ongoing basis to align with changes in industry standards and the evolving threat environment.

companyName: CHEVRON CORP

ticker: CVX


text: We have implemented incident response and breach management processes, which have four overarching and interconnected workflows: (1) detection and analysis of a security or privacy incident, (2) investigation, mitigation and remediation, (3) reporting and notification, and (4) post-incident analysis. These processes may involve participants from our information security, network, information technology, software development, executive and legal teams.

companyName: Bandwidth Inc.

ticker: BAND


text: The Company uses a reputable third -party managed service provider ("MSP") for cybersecurity support, which has operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. The Company's MSP is staffed with several security personnel, many of which have Certified Information Systems Security Professional ("CISSP") certifications.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Third-Party Vendor Management Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to Kforce as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.

companyName: KFORCE INC

ticker: KFRC


text: Our CISO has approximately 20 years of experience in the cybersecurity industry. She is responsible for developing, coordinating and overseeing our cybersecurity strategy, policy, program and solutions, and for providing cybersecurity guidance to key management and internal company oversight bodies. Our CISO manages our cybersecurity organization, which covers all regions in which we operate and which is staffed with employees dedicated full-time to cybersecurity. Our CISO reports directly to our Chief Information Officer ("CIO") and reports on cybersecurity at least quarterly to senior management and semi-annually to the full board of directors, or more often as needed.

companyName: Sylvamo Corp

ticker: SLVM


text: Utilizing the NIST cybersecurity framework, the CIO provides quarterly updates to the Audit Committee on cybersecurity risk management, including the Company's latest risk assessment, action plan status and metrics. The Audit Committee regularly briefs the full Board on these matters. In addition, the CIO provides an annual report to the Board on the Company's cybersecurity plan and key activities.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: We use third-party service providers to assist us to identify, assess, and manage risks from cybersecurity threats. These third-party service providers may include threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: Third-party Risk we are aware of the risks associated with third-party service providers, Bioxytran implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Financial Officer ("CFO"). This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by our Chief Financial Officer who oversees the work performed by our Chief Information Consultant.

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: Crucially, the Company and its suppliers strive to design and implement technical and organizational controls comprehensively, consistently and effectively as intended to protect the confidentiality, integrity or availability of systems and data. However, because the Company utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that the Company may underappreciate or not recognize a specific risk. Moreover, even the best designed and implemented security controls may not eliminate the occurrence of cybersecurity incidents.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: We have invested in robust data security and privacy protections. We follow industry-standard recommendations for data security such as those outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-171 and evolving Cybersecurity Maturity Model Certification (CMMC) frameworks. We have developed cybersecurity policies and procedures, including a data classification system to ensure the protection of critical data. In addition to periodic internal review, we also employ external auditors as needed, and cybersecurity testing firms to review our cybersecurity posture.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Our Program takes a holistic approach to organizational security focusing on both the protection of our core technologies and the protection of the operations and areas of business it supports. The Program manages 86 distinct metrics and operates 24x7x365 to meet the growing needs of Customers as it seeks to ensure the continued protection of its customers.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Under the direction and supervision of our Chief Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks we face, risks more broadly across our peers and industries, and a detailed description of the actions we have taken to mitigate these risks. The Audit Committee of the Board of Directors reviews the results of the enterprise risk assessment in detail with management on an annual basis and reports on its review to the Board of Directors each year. We provide a comprehensive update to the Board of Directors on cybersecurity at least annually, and more frequently as relevant.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and cybersecurity incidents that could affect our information or systems. For more information, see Item 1A. Risk Factors.

companyName: DevvStream Corp.

ticker: DEVS