text: As part of our cyber incident response plan, our CISO is responsible escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines. In addition, outside advisors would be engaged as deemed necessary. The CEO, CFO, and Board are informed if the incident is deemed potentially material.

companyName: TAPESTRY, INC.

ticker: TPR


text: Cybersecurity is an important element of our overall enterprise risk management program. Like other global companies, we have experienced cybersecurity threats and incidents, although none to date have been material or had a material adverse effect on our business, results of operations or financial condition. We have a multilayered approach for assessing, identifying, evaluating, managing and monitoring risks related to cybersecurity threats, that is designed to help protect our information, systems, assets and operations from internal and external cybersecurity threats and help mitigate risks of cybersecurity incidents. We invest in efforts to protect, monitor, and mitigate risks from cybersecurity threats, including through our information security function, training and compliance programs, and regular employee training.

companyName: KADANT INC

ticker: KAI

secItem: Item 1C


text: The Company has internal disclosure committees made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committees are composed of members of management and is chaired by our Vice President and Corporate Controller. The disclosure committees meet on a quarterly basis and more often if necessary. The Company has policies and procedures in place to ensure that our disclosure committees are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to management and the Board of Directors, the Risk Oversight Committee and/or the Audit Committee.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We have a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the CISO, Chief Technology Officer, Chief Legal Officer, Chief Compliance Officer, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and respond to any significant cyber incidents. The working group is expected to escalate matters of significance to our Incident Response Team, ERMC (defined below) and/or the disclosure committee, as appropriate.

companyName: StepStone Group Inc.

ticker: STEP


text: Cyber Risk Management and Strategy We plan to implement and maintain a cybersecurity risk management program under the oversight of our Board of Directors. Once implemented, this program will include systematic processes for identifying, assessing, and mitigating cybersecurity risks and will be integrated into our overall risk management processes. We intend to adopt a risk-based approach to managing cyber threats, supported by commonly used cybersecurity technologies, such as cloud-based monitoring and threat detection tools.

companyName: Natics Corp.

ticker: NTCS


text: The Company's Board provides oversight of cybersecurity risk and regularly receives updates from the Company's cybersecurity team. These updates cover topics that include cybersecurity team member updates, cybersecurity infrastructure updates, improvement in cyber-security tools and technologies, cybersecurity framework compliance, cyber-risk hardware/software enhancement updates, cybersecurity threats and mitigation measures, and more. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Willdan Group, Inc.

ticker: WLDN


text: The Global CISO manages our risk monitoring and mitigation processes and is responsible for cybersecurity risk management. The Company has adopted physical, technological and administrative cybersecurity controls and has defined procedures for incident detection, containment, response and remediation. The Global CISO works with business units and IT to ensure the appropriate policies are in place and to improve efficiency. Our global IT governance, risk and compliance team, which is a part of the GIS Program, manages IT general controls and cybersecurity best practices. We have an internal cybersecurity incident response plan designed to minimize the impact of cyber incidents and ensure consistent responses to any such incident. This plan undergoes regular reviews and updates.

companyName: BRINKS CO

ticker: BCO


text: At Genasys, cybersecurity risk management is integrated into our overall risk management program through regular internal risk assessments and continuous monitoring. Under the leadership of the Information Technology ("IT") Director, IT developed, implemented, and maintain a broad range of processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Our protocols include a third-party provided 24/7 Security Operations Center (SOC), which is designed to oversee our Endpoint Detection and Response (EDR) system and a robust Security Information and Event Management (SIEM) system that aggregates logs for real-time threat detection.

companyName: Genasys Inc.

ticker: GNSS


text: With regard to cybersecurity specifically, we have a Cyber Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Cyber Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Cyber Information Security Officer delivers an annual report to our Board of Directors.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: As of the date of this Annual Report, cybersecurity incidents and risks, separately or in aggregate, have not materially affected our business strategy, results of operations, and financial condition. However, we face ongoing risks from cybersecurity threats and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. See "Risk Factors—If we are unable to protect our sensitive data and information systems against data corruption, cybersecurity incidents or network security breaches, or if we are unable to provide adequate security in the electronic transmission of sensitive data, it could adversely affect our business, financial condition and results of operations" and "—A failure of a key information technology system or process could adversely affect the operations of our business" in Item 1A of this Annual Report for more information on our cybersecurity-related risks.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CIO and chief financial officer, regularly briefs the board of directors on our cybersecurity and information security posture, and the board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. The full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We do not currently believe cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition; however, we could experience a cybersecurity incident that materially affects us in the future. See Item 1A. Risk Factors, "Risks Related to our Information Systems and Technology" for additional discussion of cybersecurity risks to our business.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board is currently reviewing our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. The Board receives updates as needed from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: SELECTIS HEALTH, INC.

ticker: GBCS


text: The Company has processes for identifying, assessing, and managing material risks from cybersecurity threats. These processes are part of the Company's overall risk management process, as overseen by the Company's Board of Directors, with its audit committee having primary responsibility through its ongoing review of the Company's internal controls and reviewing, at least annually, the Company's information security and technology risks (including cybersecurity). These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, advisors, and/or audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate. Additionally, the Company mandates cybersecurity training as part of its company-wide employee onboarding process including best practices to identify potential cybersecurity threats and how to report such threats. The Company also requires regular ongoing cybersecurity training for employees.

companyName: iANTHUS CAPITAL HOLDINGS, INC.

ticker: ITHUF


text: of Unauthorized Activity who believe their terminal or computer systems have been subjected to unauthorized activity, or has otherwise been improperly accessed or used, are required to report the situation to the Head of IT immediately to determine the course of action.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our internal audit team performs regular assessments of our program and selected components. We also leverage retrospectives from previous cybersecurity incidents to understand weaknesses and to improve our security controls. We assess our critical suppliers regularly for cybersecurity risk and prescribe remediation activities when necessary. As a part of a collaborative defense approach, we regularly participate in multiple cybersecurity forums to share threat intelligence, best practices, and points of caution.

companyName: TORO CO

ticker: TTC


text: Our Board of Directors oversees our enterprise risk management program. The Audit Committee of our Board of Directors has the responsibility of exercising oversight with respect to our cybersecurity risk management and risk controls. Our Chief Information Officer provides periodic reports to the Audit Committee regarding our cybersecurity program, including our information risk management and oversight, security education and training, cyber threat detection and response processes, and relevant internal and industry cybersecurity attacks. The Board also receives a report out on cybersecurity issues and governance at least annually, with periodic updates as needed. Board members receive periodic presentations on cybersecurity topics from our Chief Information Officer and external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Envista Holdings Corp

ticker: NVST


text: Our IT team, including our Manager of Information Technology, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents that impact our systems and information through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our corporate IT environment.

companyName: TXO Partners, L.P.

ticker: TXO


text: Our IT policies communicate our expectations for employees and contractors regarding the security of our IT systems. We perform annual cyber security and technology processes training programs and regular third-party phishing campaigns to raise awareness of potential threats.

companyName: Green Plains Inc.

ticker: GPRE


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats (including from any prior cybersecurity incidents) have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. There can be no assurances, however, that we or our business partners or suppliers will not experience a future system disruption, attack or security breach that materially impacts our business, operations, results of operations, or financial condition. For more information refer to "Item 1A. Risk Factors, General Risks, We depend on the continuous and reliable operation and security of our information technology systems and our products and services that incorporate or rely on information technology, and any disruption or significant cybersecurity breach or other incident could adversely affect our business."

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: We operate in the biopharmaceutical sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and the results of operations, including intellectual property theft, fraud, extortion, harm to employees, third party vendors or customers, violation of privacy laws and other litigation and legal risk, and reputational risk.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: RISK MANAGEMENT AND STRATEGY MGIC's Information Security Program (ISP) includes information security policies, annual risk assessments and analyses, threat monitoring and alerting, vulnerability management, incident response, and data loss prevention controls. With the ISP, MGIC seeks to prevent, detect, and respond to unauthorized access, use, or disclosure of confidential information.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Lumen also has management level committees and response teams who support our processes to assess and manage cybersecurity risk as follows: • The Risk Oversight Committee ("ROC"), whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and General Counsel, is responsible for making risk management decisions to ensure consideration of all relevant factors and alignment with our overall risk mitigation strategy. The ROC also oversees key risk management activity to help ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board and senior management. • The Technology Security and Privacy Council, co-chaired by the CSO, Chief Information Officer, and Chief Privacy Officer, brings together IT, legal and internal audit personnel, and other function leads. The Security and Privacy Council provides a forum for these cross-functional members of management to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.

companyName: QWEST CORP

ticker: CTBB


text: Recognizing the importance of assessing, identifying, and managing material risks from cybersecurity threats, we maintain a cybersecurity program that is led by our management team and overseen by the Audit Committee of our Board of Directors. Material risks from cybersecurity threats to our company may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: NBT collaborates with external experts to conduct audits, assessments, and validations of our cybersecurity controls, aligning them with established frameworks such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We adapt our cybersecurity policies, standards, processes, and practices based on insights from these reviews.

companyName: NBT BANCORP INC

ticker: NBTB


text: The VPBO, in coordination with the SLT, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The VPBO and the SLT, through its information technology partner receives regular reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations. On an annual basis, the Audit Committee and the Board discuss the Company's approach to cybersecurity risk management with the members of the SLT, which includes the Company's VPBO, Chief Financial Officer ("CFO"), and General Counsel.

companyName: Longeveron Inc.

ticker: LGVN


text: Our Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations, the Gramm-Leach-Bliley Act and the interagency guidelines issued thereunder, and applicable laws.

companyName: Federal Home Loan Bank of Des Moines


text: The Company's CISO reports directly to the CIO, who in turn reports to the CFO. The CISO maintains the certified information systems security professional (CISSP) certification and GIAC G2700 (Certified ISO 27000 Specialist) and has over 20 years of experience in cybersecurity. Under the direction of the CISO, the Company's cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks. The team consists of cybersecurity professionals holding multiple certifications such as the CISSP, CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), GCIA (GIAC Certified Intrusion Analyst), GCFA (GIAC Certified Forensic Analyst), GNFA (GIAC Network Forensic Analyst), GCTI (GIAC Cyber Threat Intelligence), CISM (Certified Information Security Manager) and CISA (Certified Information Systems Auditor). This analysis drives the Company's long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the Board of Directors regularly.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Our Board of Directors recognizes the important role of information security and mitigating cybersecurity and other data security threats, as part of our efforts to protect and maintain the confidentiality and security of customer, employee and vendor information, as well as non-public information about our Company. Although the Board as a whole is ultimately responsible for the oversight of our risk management function, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and other technology issues.

companyName: Hanesbrands Inc.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Maintenance of IT assets, including daily security patch management. Periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts (Multi-factor authentication enforced). Network integrity is safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, spam gateway filtering, data loss prevention policies, SaaS monitoring, and remote monitoring on all devices. Industry-standard encryption protocols on workstations and email, critical data backups, and infrastructure maintenance. Incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation are maintained and supplied by a 3rd part SOC (Solutions Granted) that is NIST 800-171 compliant.

companyName: OLENOX INDUSTRIES INC.

ticker: OLOX


text: The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity program takes into account recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.

companyName: Guardant Health, Inc.

ticker: GH


text: Education and Awareness Our Company policies require our employees to assist in the protection of our customers' data. We have various training programs, conducted frequently, designed to heighten employees' awareness of current threats, educate them on effective mitigation strategies and reinforce the importance of handling and safeguarding customer and employee data in accordance with our established security protocols. To evaluate the effectiveness of these training programs and monitor the effectiveness of our security controls, we have implemented mock testing practices. Annual incident response training is conducted for administrative personnel that would be expected to be involved with, and respond to, a security incident.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO and senior executives from Key's LOB and major support areas. The CMT provides overall strategic direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key's risk governance committee structure.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our cybersecurity program is managed by our Information Technology Manager and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Information Technology Manager and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.

companyName: Nutex Health Inc.

ticker: NUTX


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading " A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results" in our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: ROYAL GOLD INC

ticker: RGLD


text: We use a collaborative, enterprise-wide strategy to address cybersecurity risks and allocate significant resources to our cybersecurity and risk management processes, which efforts are intended to adapt to the evolving cybersecurity landscape and promptly address emerging threats. Our cybersecurity risk management program aligns with the National Institute of Standards and Technology framework and is organized into five key functions: identification, protection, detection, response and recovery. We regularly assess the threat landscape and employ a layered cybersecurity strategy to prevent, detect and mitigate threats.

companyName: MASTEC INC

ticker: MTZ


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including enforcing single sign-on or multi-factor authentication where supported or appropriate. We engage third-party cybersecurity experts to assess the security of our network. In addition, we engage a third-party to perform internal audits of our IT General Controls (ITGCs).

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on relevant cybersecurity topics from our Senior Vice President of Security Operations and internal security staff.

companyName: EverCommerce Inc.

ticker: EVCM


text: Risks Associated with Cybersecurity The Company is often targeted in an effort to obtain unauthorized access to its financial records and confidential information, destroy data, disable or degrade service, or sabotage systems. Such attacks may take various forms, including the introduction of computer viruses or malware, ransomware, phishing attacks, cyber-attacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. To date, these threats and attacks have not resulted in a material cybersecurity incident. However, a material failure, interruption or security breach could adversely affect the Company's business and operations through financial losses, remediation expenses, reputational damage, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance. For more information on risks to the Company from cybersecurity threats, see "Risk Factors – Operational Risks".

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Commitment to Security Security is a foundation on which ZoomInfo builds and maintains customers' trust. We are committed to protecting our information and our customers' information from both intentional and unintentional misuse and have implemented a robust Information Security Management System ("ISMS") that meets the ISO 27001 Standard requirements as well as the ISO 27701 (Privacy) and ISO 27017 (Cloud Security) standards. We have also earned AICPA's SOC 2 attestation regarding the security, availability, and confidentiality controls around our services and meet the security requirements of the Cloud Security Alliance (CSA) STAR program.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Security Officer (CISO).

companyName: PFIZER INC

ticker: PFE


text: The Company's cybersecurity programs are supported by experienced and knowledgeable leaders. The CISO has served in various roles related to information technology and information security for over 20 years. The CISO maintains relevant certifications, including Certified Information Systems Security Manager ("CISM") and Certified Information Systems Auditor ("CISA"). Additionally, several cybersecurity team members reporting directly to the CISO maintain certifications, including CISM, CISA and Certified Information System Security Professionals ("CISSP"). The Company's Chief Digital & Information Officer has over 30 years of experience with information technology and digital strategy. The Company's CEO, CFO and General Counsel each have over 20 years of experience managing risk at the Company or at similar companies or in related settings, including risks arising from cybersecurity threats.

companyName: REGAL REXNORD CORP

ticker: RRX


text: As part of our cybersecurity risk management system, we track and log privacy and security incidents across IGI, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional team to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: INFINITE GROUP INC


text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following: • industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, patch management, email security and firewalls to protect our assets and our ability to maintain operations; • use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response, security information and event management and vulnerability management; • a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center; • regularly monitoring and assessing our cybersecurity programs using external parties including a third-party 24/7 security operations center and by conducting periodic cyber maturity and risk assessments, penetration tests and other targeted controls assessments; • central systems backup processes and associated disaster recovery plans; • membership in an information sharing and analysis center and other industry groups so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and • employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical IT service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes processes for performing due diligence upon on-boarding.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Our Cybersecurity Risk Management Approach OFS Advisor utilizes the IT department ("IT Department") of CIM Group, LLC ("CIM Group"), an affiliate, as its IT administrator. The IT Department is responsible for the design and implementation of OFS Advisor's IT environment and controls, including policies and procedures to identify, assess and manage material risks from cybersecurity threats, which are integrated into OFS Advisor's internal controls and IT systems.

companyName: OFS Capital Corp

ticker: OFS


text: The Company depends on and engages various third parties, including suppliers, vendors and service providers, to operate its business. The Company takes steps to identify and oversee risks from cyber security threats associated with our use of such entities, and the Chief Compliance Officer of the Company periodically reviews cyber security-related reports regarding key service providers.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Our Chief Executive Officer, General Counsel and Chief Accounting Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers and outside counsel, as needed.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: The Company's CIO has been and continues to be responsible for Global IT, including overseeing cybersecurity and its digital strategy. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at Rogers Corporation, a global high tech manufacturing company, as well as other global manufacturing companies.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We have established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Our Board of Directors provides oversight of our enterprise risk management, including our approach to managing cybersecurity risk, and has delegated responsibility for review of information security risks to its Audit Committee. The Audit Committee regularly reviews information security risks and receives reports from our Chief Information Officer and other members of the Company's management regarding those risks. Our cybersecurity program is managed by a dedicated Chief Information Officer whose global team, including the Director, Information Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Chief Information Officer has over 28 years of relevant industry experience, including 17 years with Merit. Our Director, Information Security, functions as our senior information security officer and has over 17 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as Certified Information Systems Security Professional.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: The cybersecurity team under the direction of the Corporation's Chief Information and Digital Officer ("CIDO"), is responsible for assessing, deploying, and managing the cybersecurity risk management program. Recognizing the complexity and evolving nature of cybersecurity threats, the cybersecurity team engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing the Corporation's risk management systems. The collaboration with these independent third-parties includes regular threat assessments, such as penetration tests and table-top exercises, and consultation on security enhancements. In addition, the cybersecurity team provides training to applicable members annually and ongoing cybersecurity education. Additionally, the Corporation maintains cyber risk insurance.

companyName: HNI CORP

ticker: HNI


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Advisor. The Board is also made aware of material cybersecurity incidents which impacted the Fund.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • third party engagements to perform periodic penetration testing and reviews of program maturity based on industry standard frameworks; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations.

companyName: GRAYBAR ELECTRIC CO INC


text: ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES Our supply chain risk management practices include risk assessments of suppliers, including with respect to cybersecurity. We monitor our suppliers using commercially available services that provide real-time security scoring of supplier technology services, threat intelligence, financial intelligence, geopolitical risk intelligence, and other considerations related to cybersecurity. Reviews are also regularly performed to monitor changes in suppliers' cybersecurity risk posture. Continuous threat intelligence monitoring is also performed to identify potential cybersecurity incidents involving third parties. We strive to negotiate appropriate provisions with respect to cybersecurity in our contracts with suppliers.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Our cybersecurity program is designed to safeguard our information systems and protect confidentiality, integrity, and availability of those information systems and the information residing therein. Our cybersecurity risk management program is integrated with our broader enterprise risk management programs under the oversight of our Chief Administrative Officer ("CAO") and the Enterprise Risk Management Committee. The CAO reports to the CEO and is responsible for our overall information and data security strategy, cybersecurity risk policies and procedures, as well as evaluating and managing any material risks from cyber threats. Our Chief Information Security Officer ("CISO") reports directly to our CAO and leads our cybersecurity and compliance department.

companyName: TRIUMPH GROUP INC


text: Management, including various functional teams, is responsible for assessing, identifying, and managing material risks from cybersecurity threats. Valvoline continually evaluates and updates its cybersecurity programs to align with regulatory requirements and industry best practices. This includes keeping company-wide training initiatives related to cybersecurity risks robust and up-to-date.

companyName: VALVOLINE INC

ticker: VVV


text: The Information Security team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar's Information Security team to protect our information technology environment. Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: To our knowledge cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K"Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."

companyName: Carlyle Credit Solutions, Inc.


text: Our platform and corporate systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. We also use vendors to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats to our platform and corporate systems, including consulting firms, external legal counsel, incident response vendors, penetration test providers, auditors, monitoring technology, and cybersecurity data providers. We have a vendor management program under which our corporate security, product security, and legal teams evaluate cybersecurity risks presented by our use of vendors. Depending on the nature of the technology or services provided, the sensitivity of the information systems and data at issue, and the identity of the vendor, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. For vendors that may pose higher risks, this process includes a vendor security questionnaire, an evaluation of the vendor's security program and security documentation, and the imposition of contractual obligations related to cybersecurity on the vendor. All vendors are required to undergo this review, which is in addition to the applicable security reviews that may be conducted by our product security and corporate security teams described above.

companyName: Snowflake Inc.

ticker: SNOW


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer, Chief Information Officer, and our management technology steering committee. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant certifications, including Certified Information Security Manager and Certified Information Systems Security Professional.

companyName: Mechanics Bancorp

ticker: MCHB


text: In addition, we maintain a third-party cyber risk management process for vendors including, among other things, a security assessment and contracting program for vendors based on our assessment of their risk profile and periodic monitoring regarding adherence to applicable cybersecurity standards. We require our third-party service providers and suppliers to implement and maintain appropriate security measures commensurate with their risk profile and the scope of work being performed. We reassess third-party risk profiles periodically, request changes as we deem necessary based on that review, and require all third parties to promptly report any suspected breach of their security measures that may affect us.

companyName: Seagate Technology Holdings plc

ticker: STX


text: Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a global incident response capability supported by our Security Operations Center (which we refer to as SOC) team, a managed security service provider (MSSP) and our global Cybersecurity Incident Response Team (which we refer to as CSIRT), which provides threat detection and incident response.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Annually, the Audit and Risk Committee reviews and recommends for approval to the Board the Company's Information Security Policy, which outlines the roles, responsibilities, and objectives for the Program. On a quarterly basis, the Company's Chief Information Security Officer ("CISO") presents the Company's cybersecurity report and related material for review by the Audit and Risk Committee and then by the Board. This report includes emerging risks, overall program effectiveness/status, cybersecurity incidents, staffing, risk exceptions, and recommended enhancements to the program, as applicable. Annually, the CISO provides security related education to the Board and to the Audit and Risk Committee.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: While we occasionally experience cybersecurity threats and incidents, we are not aware of any material risks from these threats, including from past incidents, that have materially affected or are likely to materially affect our business strategy, financial condition, results of operations, or cash flows. However, there is no assurance that future cybersecurity threats will not have a material impact. For more information on our cybersecurity-related risks, please see "Item 1A. Risk Factors."

companyName: EGAIN Corp

ticker: EGAN


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal and compliance), as well as senior leadership and the board of directors, as appropriate.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: We did not experience a material cybersecurity incident during the fiscal year ended December 27, 2024. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: Sponsor Oversight: The Sponsor of the Fund has a fundamental role in overseeing the Funds' cybersecurity risk management. The Sponsor receives regular updates on cybersecurity matters from management and third-party service providers, ensuring that cybersecurity risks are managed proactively at the highest level of the organization.

companyName: VS Trust

ticker: SVIX


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Using people, processes, and technology, we employ a variety of preventative and detective tools designed to monitor, alert, contain, and/or block suspicious activity. We design and implement controls designed to mitigate cyber risk, including ongoing education and training for employees and customers, preparedness simulations and tabletop exercises, and recovery and resilience tests. We actively monitor email for malicious phishing email campaigns and monitor remote connections. Additionally, we maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers.

companyName: SIERRA BANCORP

ticker: BSRR


text: We strive to implement and maintain layered controls designed to prevent and, where necessary, detect and respond to cybersecurity threats. Our physical controls are designed to restrict access to locations that house significant physical information technology assets. Our technical preventive controls include access restrictions and network security technologies. Our notification policies and processes are designed to have notifications and alerts escalated to the appropriate personnel on a timely basis to support effective review, response and compliance with legal requirements. In addition to event-specific notifications, data is aggregated and compiled on a regular basis to support the identification of trends and effective program review and oversight. We also recognize that Danaher is exposed to cybersecurity risks that affect third parties whom we rely on to process, store or transmit our electronic information. To manage these risks, we maintain technical security controls as well as processes designed to facilitate Danaher's identification of third-party cybersecurity risks.

companyName: DANAHER CORP /DE/

ticker: DHR


text: Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management (i) has policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed and (ii) takes steps to mitigate or remediate cybersecurity risks, threats and incidents, including monitoring the activities of the cybersecurity team and reviewing and updating our cybersecurity policies, processes and procedures. The Audit Committee also reports material cybersecurity incidents to our full Board of Directors.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats. Liberty's corporate level IT and cybersecurity functions assess, identify, and manage risks from cybersecurity threats at the corporate level, while Formula 1 operates its own cybersecurity function with oversight from Liberty.

companyName: Liberty Media Corp

ticker: FWONA


text: The Company's Board of Directors has oversight responsibility for cybersecurity risks and receives information from management regarding cybersecurity matters as appropriate. Management is responsible for day-to-day cybersecurity risk management, including oversight of third-party service providers and responding to potential cybersecurity incidents.

companyName: REST EZ Inc.

ticker: RTEZ


text: ESRT's Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of ESRT's Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile on a quarterly basis. Our Chief Technology Officer is responsible for leading the assessment and management of cybersecurity risks and reports at least quarterly or more frequently as needed to the Audit Committee on cybersecurity strategy and risks.

companyName: Empire State Realty OP, L.P.

ticker: ESBA


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Security tools deployed in the IT environment for protection against and monitoring of suspicious events; • Security awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers, suppliers, and vendors who access our data and/or systems.

companyName: Lemonade, Inc.

ticker: LMND


text: Audit Committee of our Board of Directors oversees our policies and procedures with respect to risk management, including our management of risks from cybersecurity threats. The Audit Committee administers this cybersecurity risk oversight function through the receipt and review of reports from the management team and the vCIO on the Company's information technology systems and the status of the cybersecurity risk management tools.

companyName: Vivani Medical, Inc.

ticker: VANI


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: The Company's ISO, supported by skilled internal personnel, is responsible for identifying, assessing and managing cybersecurity risks and designing, implementing and maintaining the Company's information security program. The ISO has many years of experience and holds multiple certifications appropriate to the role. The ISO reports to the Senior Vice President/Sr. Operations, Risk & Technology Officer and the Board of Directors. Management's enterprise risk management committee receives regular updates from the ISO on cybersecurity related risks, including trends and emerging threats.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the Company's networks, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. The Company's management team reviews the findings, if any, of these assessments, assesses the identified risks, and takes action based on the Company's risk profile. In order to assess the risks posed to the Company's information systems by third-party service providers and vendors, the Company's internal audit services team evaluates new software and network application vendors' contracts, internal policies, certifications, and System and Organization Controls ("SOC") reports during the procurement of solutions and services.

companyName: SITE Centers Corp.

ticker: SITC


text: We recognize the critical importance of maintaining the safety and security of our information systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by our senior leadership team, the Audit Committee, and our Board of Directors.

companyName: APi Group Corp

ticker: APG


text: We have a retainer agreement with a reputable cyber incident response team, who assists the Company in reviewing the cyber incident response plan and conducting yearly tabletop drills. The experts on the cyber incident response team are available on a priority basis to assist the Company with forensics and other sophisticated analyses and investigations in case of a cyber incident for quick response and efficient recovery.

companyName: International Seaways, Inc.

ticker: INSW


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee at least quarterly our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes.

companyName: Broadcom Inc.

ticker: AVGO


text: The Account depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Account relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Account's use of such entities.

companyName: TIAA REAL ESTATE ACCOUNT


text: We prioritize the management of cybersecurity risk and regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity program.

companyName: Rithm Capital Corp.

ticker: RITM


text: We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We will seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We will engage a third-party consultant, if needed, to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.

companyName: AI Era Corp.

ticker: AERA


text: Our Enterprise Security Program is led by the ISO. The ISO reports to the Chief Risk Officer (CRO). FHLBank's Information Security area is led by the Director of Information Security, who reports to the Chief Information Officer. The Business Resiliency Management Program is led by the Director of Vendor Risk and Business Resiliency, who reports to the Associate CRO.

companyName: Federal Home Loan Bank of Topeka


text: Tilray recognizes the importance of cybersecurity in safeguarding our systems, data, and operations and we are committed to addressing the significant risks posed by cyber threats. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Through our IT Steering Committee, the Director of Global IT provides regular reports to the CFO on cybersecurity metrics and any cybersecurity incidents. The Company's Director of Global IT is responsible for developing and implementing the information security program and reporting on cybersecurity matters to the CFO and the IT Steering Committee. Our IT Steering Committee is comprised of representatives from Information Security and Technology, Internal Audit and members of executive management. This committee meets periodically to discuss and review Manitex's information security program and receives updates from the Information Security and Technology Department and Internal Audit Department.

companyName: Manitex International, Inc.


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the Ares ERC periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares' Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Given our current stage of cybersecurity development, we have no t experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: The Company may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls we implement and it is possible that we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon. Governance.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: Our Vice President of Information Technology ("IT") oversees overall cybersecurity management and implements our cybersecurity programs with the IT group, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic reports to our Audit Committee at least semi-annually. The Vice President of IT holds an undergraduate degree in Computer Engineering and has served in Information Technology & Security roles dedicated to the Pharma & Biotechnology sector for the last 15+ years, including serving as the Chief Information Officer of another public biopharmaceutical company.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: We recognize the paramount importance of cybersecurity in preserving the integrity, confidentiality, and availability of our systems, data, and operations. We are committed to maintaining a comprehensive cybersecurity posture that encompasses proactive risk management, robust defense mechanisms, and continuous monitoring. To this end, we employ a multifaceted approach to cybersecurity, which includes regular assessments of our infrastructure, applications, and processes to identify vulnerabilities and weaknesses. Furthermore, we prioritize ongoing employee education and awareness initiatives to cultivate a culture of security throughout our organization. Our workforce receives regular training on best practices, emerging threats, and incident response procedures to empower them to be active participants in our cybersecurity efforts. Additionally, we enforce strict access controls and data encryption protocols to safeguard sensitive information and mitigate the risk of unauthorized access or data breaches.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our cybersecurity program incorporates several control and best practice regimes, including for example, the Center for Internet Security ("CIS") controls. We conduct regular internal and external assessments, audits, and tabletop exercises to assess security vulnerabilities, control compliance and incident preparedness. These assessments and exercises include red team exercises simulating external attacks, threat and vulnerability assessments, ransomware, application, and secure image testing, crisis management exercises, including incident response, and internal audit reviews. Management and the Board's Cybersecurity Committee reviews the results of these exercises, audits and assessments. We also actively engage with third parties, such as key vendors, auditors, consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program. We monitor emerging data protection laws and cybersecurity and privacy regulatory requirements and implement changes to our standards and processes for continued compliance. Our cybersecurity program also includes employee and contractor training, which primarily consists of monthly educational videos, annual trainings and certifications, and phishing exercises.

companyName: VERISIGN INC/CA

ticker: VRSN


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report.

companyName: MDWerks, Inc.

ticker: MDWK


text: Our CISO and CIO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Associates must also follow established procedures for the safe storage and handling and secure disposal of customer information. Old or obsolete computer assets are subject to defined procedures and processes to ensure safe destruction of information contained on those devices. For paper-based information or documents, we dispose of paper using shred bins for destruction.

companyName: FIRST BANCSHARES INC /MS/


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and regularly meets with the IOC, without other members of management present, during executive sessions. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity team, who are tasked with these responsibilities on a day-to-day basis.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: If an event is identified as an incident, the CIRP provides for notification to designated members of the Cybersecurity Department and the legal compliance function who will analyze the incident for potential materiality. Any incident whose impacts are judged to be potentially material is escalated immediately to a senior management team comprised of at least our CIO, Chief Legal Officer, Chief Operations Officer, and Chief Financial Officer. Additionally, certain cybersecurity events, such as a ransomware attack, will be immediately escalated to the designated members set forth above and the CIO. If the threat is found to be credible, it is further escalated on an emergency basis to the Chief Legal Officer and Chief Financial Officer. Once a cybersecurity incident is escalated to senior management, other members of management and senior management may be engaged to oversee the assessment, response, recovery, and disclosure efforts relating to such cybersecurity event.

companyName: ACV Auctions Inc.

ticker: ACVA


text: At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company's cybersecurity defenses on an ongoing basis. The CISO, together with other members of the IRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Tech Oversight Committee periodically. The Board of Directors meets with the CISO periodically to discuss cybersecurity.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: The Audit Committee also periodically receives reports on notable cybersecurity incidents. The Audit Committee periodically briefs the full Board on these matters.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: The routine reporting to the Audit and Risk Committee and the Board includes as appropriate the highlights from the full spectrum of work done within the Company's cybersecurity program. The briefings by the CISO to the Audit and Risk Committee and Board also include the review of certifications and cybersecurity maturity assessments by management and third parties.

companyName: AUTOLIV INC

ticker: ALV


text: cybersecurity awareness training of our employees, incident response personnel, and senior management not less often than once per calendar year;

companyName: Endeavor Group Holdings, Inc.


text: CMS Energy's and Consumers' cybersecurity program focuses on finding and remediating vulnerabilities in their systems. The companies use third-party firms for penetration testing, audits, and assessments, and conduct exercises to practice their response to simulated events. The companies also have a dedicated, proactive function focused fully on monitoring CMS Energy's and Consumers' systems and responding when issues occur. This includes regular information sharing with industry partners, peer utilities, and state and federal partners. The companies' incident response plan outlines the individuals responsible, the methods employed, and the timeline for notifying state and federal governmental agencies. The companies retain a third-party cybersecurity firm to assist with potentially significant incidents and have invested in cybersecurity insurance to offset costs incurred from any such incidents. To manage cybersecurity risks associated with the companies' use of third-party service providers, the companies incorporate security requirements into contracts, when deemed applicable, and pursue third-party security certifications for vendors with a higher risk profile.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Our Board has delegated primary responsibility to oversee the management of risks related to information technology use and protection, including cybersecurity and data privacy, to the Audit Committee, while retaining oversight of management's overall approach to risk management. The Audit Committee receives regular reports regarding our cybersecurity risks through two annual briefings by senior management, including our Chief Information Security Officer ("CISO") and head of data privacy, and additional periodic updates as appropriate. In addition, members of our management team conduct an enterprise-wide internal risk assessment through our ERM program that is updated annually and reviewed and discussed by the Audit Committee. This risk assessment is designed to identify our most material risks, including cybersecurity risks, for evaluation and monitoring. At each Board meeting, the chairperson of the Audit Committee and the Corporate Secretary report on the Audit Committee's activities, including risk management, which provides an opportunity to discuss significant cybersecurity risks with the full Board.

companyName: Under Armour, Inc.

ticker: UAA


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from IPSIPay Express and third parties like OpenPath, EfinityPay, vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data.

companyName: Innovative Payment Solutions, Inc.

ticker: IPSI


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our Information Security Program team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments.

companyName: First Foundation Inc.

ticker: FFWM


text: Prospect Capital Management has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on, or through, our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: vCIO services include: (a) operational review, strategic planning, technology road-mapping; (b) development of a custom IT policy/handbook; and (c) reporting in accordance with the service level agreement and support commitment adherence data to Lightbridge via MSP's Service Delivery Team.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: We have begun to conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our vendors and service providers.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: Monitor Cybersecurity Incidents Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CISO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Currently, we have not identified risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

companyName: TSS, Inc.

ticker: TSSI


text: Our Operational Risk Committee ("ORC"), chaired by our CISO, provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor, and report information security risks associated with our information and information systems. The ORC escalates risks to the Risk Management Committee or our Board based on the escalation criteria provided in our information security framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Management Committee and the ORC.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: The CISO is also responsible for supervising and monitoring certain outside professionals or third party service providers that assist in enhancing the Company's current cybersecurity safeguards. The Company has invested meaningful resources to address cybersecurity threats and partners with leading technology companies to implement solutions to address the fast-evolving threat landscape. These solutions and services help with the prevention, detection, mitigation and remediation of cybersecurity threats and incidents.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Each Registrant relies on technology in virtually all aspects of its business. Like any business, the Registrants' technology systems are a target for cyber attacks. Each Registrant expects to be subject to attempted attacks in the future and will continue to adapt defensive capabilities as such attacks become more sophisticated and frequent. A significant disruption or failure of its technology systems by cyber or physical attack could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against each Registrant's systems could result in loss of assets and critical information and expose it to remediation costs and reputational damage.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Our Information Security (InfoSec) Governance, Risk and Compliance (GRC) organization leverages multiple methods and overlapping capabilities to protect the confidentiality, integrity and availability of our data, information and intellectual property. Assessments of Wolfspeed's cyber program are conducted by internal audit and third-party information and cyber experts to monitor the effectiveness and maturity level of Wolfspeed's cybersecurity program.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and includes technical, administrative and physical controls, including encryption, firewalls, anti-virus systems and well-documented processes and policies. We continue to promote a company-wide culture of cybersecurity risk management. Cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Vice President of Information Systems, who has many years of experience in IT management, and reports directly to the Chief Executive Officer and works closely with our management team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our VP of Information Systems provides regular updates on cybersecurity to the Audit Committee of the board of directors. Our board of directors, as a whole and through the Audit Committee of the board of directors, exercises oversight with respect to cybersecurity and our risk management strategy, consistent with its approach to overseeing our enterprise risk management as a whole.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Management and Board Reporting Cybersecurity incidents are reported directly to the SDIS in accordance with the applicable incident response plan. The SDIS, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee. The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect, mitigate and remediate a cyber security incident, the following key processes and programs have been implemented and are performed by the Company's Cyber Security Group, which is overseen by the Chief Information Security Officer: • Implementation of security solutions and standards based on industry best practices to prevent unauthorized access. The Company's cyber program has been modeled after the Department of Energy's Cyber Capability Maturity Model and the National Institute of Standards and Technology framework; both widely accepted frameworks utilized by utilities and other critical infrastructure industries. • Periodic external assessments, including outside system access testing, are performed. Rigorous auditing of all safeguards is performed on a regular basis. Risk assessments are held to identify and address new and changing risks to protect systems and sensitive data. Identified areas are monitored and improvements are implemented. • Eversource participates in information sharing programs both within and outside the utility industry, including with the U.S. government and industry organizations, to be able to identify and respond to emerging threats. • Established an Artificial Intelligence Executive Working Committee to ensure a "Secure by Design" approach to implementations of artificial intelligence. • The Company maintains current incident response and business continuity plans, which are periodically updated and tested. • Network activity is monitored on an ongoing basis. • Anti-phishing and malware tools are utilized and assessed. • Employees are trained to recognize phishing attempts and are periodically tested. Results of phishing testing are benchmarked against other companies both within and outside the utility industry.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: Our cybersecurity policies and controls encompass incident response procedures, information security, and IT vendor risk management. We monitor the cybersecurity laws, regulations, and guidance applicable to us in the maintenance of these policies and procedures, including, but not limited to, regulations issued by the U.S. Department of Homeland Security, as further described in Item 1 (Business) of this Annual Report on Form 10-K, as well as proposed laws, regulations, guidance, and emerging risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT security, governance, risk and compliance reviews, external audits and assessments, penetration tests, vulnerability scans, and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Our Vice President, Global Information Security has 28 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 22 years with Owens Corning, and reports directly to our CIO.

companyName: Owens Corning

ticker: OC


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: AUTONATION, INC.

ticker: AN


text: We have an enterprise-wide information security program designed to protect, identify, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Furthermore, to protect our information systems and data from cybersecurity threats, we use various security tools that help prevent, identify, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third party risk management program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risks, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: RingCentral, Inc.

ticker: RNG


text: Roper deploys cybersecurity practices and tools across all of its businesses to protect data, maintain resilient operations, and limit the impact of cybercrime. We deploy a Managed Detection and Response ("MDR") solution across all of our business units and our Corporate infrastructure designed to address the detection, response, and remediation effectiveness of cybersecurity threats. This solution is intended to provide real-time visibility of the endpoint footprint across the enterprise, including patch management and vulnerabilities, device encryption, and cybersecurity threats and detections.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: With regard to risks posed by third-party vendors and service providers, Voya has a dedicated team that is responsible for evaluating, assessing, and addressing those risks, with the ultimate goal of protecting sensitive information and the security of our operations and systems supported by those vendors and providers using a risk-based approach. This team conducts due diligence on third-party vendors and service providers, including evaluating their information security controls and related measures, to identify potential risks and implement appropriate controls.

companyName: Voya Financial, Inc.

ticker: VOYA


text: Our information security program is managed by a dedicated Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Information Officer provides periodic reports to our Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NorthEast Community Bancorp, Inc./MD/

ticker: NECB


text: The Audit Committee of our Board reviews and oversees the implementation of our policies and procedures related to cybersecurity risk assessment and management.

companyName: Aspen Technology, Inc.