text: Although no cybersecurity incident during the year ended December 31, 2024 resulted in an interruption of our operations, known losses of critical data, or otherwise had a material impact on Avantor's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on how material cybersecurity attacks may impact our business.

companyName: Avantor, Inc.

ticker: AVTR


text: GM has a Cybersecurity Management Board that brings together representatives from senior management across the Company's Software & Services, Product Development, Information Technology, Manufacturing, Finance, Communications, Human Resources, Legal and Public Policy organizations to provide guidance and monitor overall company cybersecurity risk. The Company's cybersecurity maturity scorecard, cybersecurity threats and certain incident information are reviewed by the Company's Chief Cybersecurity Officer (CCO), the Risk and Cybersecurity Committee of the Company's Board of Directors and the Cybersecurity Management Board during standing meetings as well as in impromptu sessions, when appropriate. During the reviews, various topics are discussed, which may include: • implementation and maturity of the Company's cybersecurity program, risk management framework, including cybersecurity risk policies, procedures and governance; • cybersecurity and privacy risk, including potential impact to the Company's employees, customers, supply chain, joint ventures and other stakeholders; • intelligence briefings on notable cyber events impacting the industry; and • cybersecurity budget and resource allocation, including industry benchmarking and economic modeling of various potential cybersecurity events.

companyName: General Motors Co

ticker: GM

secItem: Item 1C


text: At Dun & Bradstreet, we are committed to identifying, categorizing, evaluating, managing, and mitigating risks related to our data, technology, and operations through our enterprise risk management ("ERM") program, our cybersecurity ("Cyber") program, and our compliance and ethics ("C&E") program. Our ERM, Cyber, and C&E programs continuously coordinate on vulnerability, threat, and risk monitoring and periodic reporting to provide a comprehensive view of evolving cybersecurity risks. Through these programs, we evaluate risks at various levels ranging from systems, applications, processes, products, and analytics, to incidents, and macro and aggregate risks in the environment and ecosystems in which we operate. We also utilize this risk-based approach to assess, identify and manage risks from cybersecurity threats associated with third parties with whom we do business, including those that provide services, systems, and data processing. We apply consistent methodologies to evaluate inherent and residual risk levels to identify and prioritize management of our highest risks, including material cybersecurity risks.

companyName: Dun & Bradstreet Holdings, Inc.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. Our Board of Directors has elected to exercise direct oversight over this area, rather than acting through one of its committees, given the increasing importance of cybersecurity matters and the cross-functional impacts of technology on our business. Our Board of Directors receives reports at least twice per year from members of senior management, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer, regarding the Company's information systems and technology and associated policies, processes, and practices for managing and mitigating cybersecurity and technology-related risks. Our Board of Directors also meets with external advisors to discuss technology and cybersecurity risks applicable to the Company and obtains perspectives which inform senior management's discussions with our Board of Directors. Our Board of Directors has delegated oversight of the process for determining disclosure required with respect to cybersecurity incidents to its Audit Committee.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats.

companyName: AA Mission Acquisition Corp.


text: Our management team has engaged third-party experts to provide guidance related to management of supply chain cybersecurity risks. Our strategy includes both short- and long-term initiatives to increase the security surrounding our assets and is supplemented using third-party threat monitoring, rigorous security protocols, and government partnerships. We perform cybersecurity assessments with respect to third parties who provide critical services or who have access to or store critical confidential data.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: Business email compromise ("BEC") continues to be a top threat for cybersecurity risk leading to potential financial loss, data breach or further information systems compromise. Variants and combinations of BEC, including phishing, spear phishing, "adversary in the middle" attacks (i.e., attacks that allow interception of network communications) and, in particular, "zero-day" attacks (i.e., attacks that exploit a previously unknown vulnerability), present a financial, data loss and business continuity risk. The risk of these attacks exists within the Company, within our customer partners and within our vendor partners in the supply chain. BEC prevention is a top focus in our risk-based cyber-resiliency strategy. In addition to BEC, potential vulnerabilities could exist in business systems and associated infrastructure and are mitigated via protocol for managing update "patches"; this protocol is sometimes limited based on the era of legacy systems.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: To design and update our cybersecurity strategy, including awareness, prevention, detection, response and recovery components, we strive to align with a respected maturity framework, and we periodically, with the help of a third-party, analyze our alignment. We use a variety of tools to help identify anomalous activity on our systems, including without limitation logs, artificial intelligence, software programs, and data analyses. In addition to internal resources, we use third-party services and software to monitor our cyber environment for detected risks, including without limitation risks from cyber-attackers, employees, and third-parties that we allow to access or contribute to our information technology systems, and to block threats. To assess system vulnerability, we periodically simulate threats, and following such exercises, we assess penetration results and determine and implement remediations.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Additionally, we have established the Extended Cyber Crisis Response Team ("ECCRT"). The ECCRT is a cross-functional incident response team comprised of senior leaders from across the various departments of the organization that, in the event of a cyber incident, helps lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.

companyName: Cencora, Inc.

ticker: COR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: The Company's information security program, led by our CTO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools. We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders. We regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of both internal and external resources.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company's General Counsel.

companyName: Root, Inc.

ticker: ROOT


text: Our CISO, who reports to our Global Technology Officer on the Management Committee, has over 20 years of information technology and security program management experience, holds a Certified Information Security Manager certification and has led our information security team, including information technology compliance and risk management, since 2009. Our Global Technology Officer joined the Company in 2016 and has over 30 years of information technology experience, including leading global digital, security, infrastructure, cloud services and application teams. Prior to joining the Company in 2016, our Global Technology Officer was chief information officer at a large, publicly-traded energy company.

companyName: ASSURANT, INC.

ticker: AIZ


text: In the event of an incident, we intend to follow our detailed incident response policy and procedure, which outlines the steps to be followed from incident detection to mitigation, including notifying functional areas (e.g. legal), as well as senior leadership and the board of directors, as appropriate. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Any significant disruption to our service or access to our systems could affect our business and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. For more information regarding risks surrounding cybersecurity, please see "Risk Factors" of this Annual Report on Form 10-K.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: Until November 2023, our Board had oversight responsibility for cybersecurity threats, and the SVP of IT provided cybersecurity-related information to the Board on a periodic basis. In November 2023, the Board formed a Cybersecurity Special Committee which had oversight over our management of cybersecurity threats and until November 2024, was charged with periodically reporting on cybersecurity matters to the Board. The Cybersecurity Special Committee consisted of four independent directors. In January 2025, the Board changed the Cybersecurity Special Committee to be a subcommittee of the Audit Committee (the "Cybersecurity Subcommittee"). The Board's oversight, including through the Cybersecurity Subcommittee, includes receiving periodic reports from the SVP of IT and other information technology team members on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. In addition, the Cybersecurity Subcommittee is tasked with oversight of our annual cybersecurity assessment of key cybersecurity risks.

companyName: ARKO Corp.

ticker: ARKO


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity and technology risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our Board of Directors (the "Board) considers evaluating and proactively addressing cybersecurity risk as part of its risk oversight function and has delegated to the Board's Nominating and Corporate Governance Committee (the "Committee") oversight of cybersecurity and other information technology risks facing us and our businesses. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: System1, Inc.

ticker: SST


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity program and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's Vice President of Information Technology regularly addresses the Audit Committee, typically on a quarterly basis, regarding our cybersecurity and data privacy progress to the NIST CSF standards along with briefing the Committee on any cybersecurity incidents that were determined to have a moderate or higher impact on the business, even if immaterial to the Company as a whole. In the event of an incident, management intends to follow the Company's incident response plan, which outlines the steps to be followed from the detection of an incident to mitigation, recovery, and notification, including notifying functional areas, as well as senior leadership and the Audit Committee, as appropriate. Determination of when to notify senior leadership and the Audit Committee is made by the Vice President of Information Technology in consultation with other members of senior leadership as needed. Depending on the nature and severity of the incident, disclosure can be handled either through scheduled quarterly reporting to the Audit Committee or as an immediate disclosure to the Chair of the Audit Committee.

companyName: Andersons, Inc.

ticker: ANDE


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor "Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impact on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us." in "Item 1A. Risk Factors" of this Form 10-K for more information.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our COO.

companyName: EMERSON RADIO CORP

ticker: MSN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and commercial and pipeline tests ("Information Systems and Data").

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. We employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.

companyName: ESAB Corp

ticker: ESAB


text: Our CISO, who has over 20 years of experience in cyber security and technology, oversees the implementation and compliance of our information security standards and mitigation of information security related risks. We also have management level committees and a cybersecurity incident team that support our processes to assess and manage cybersecurity risk as follows: • Privacy is co-chaired by the CISO and Assistant General Counsel. They bring IT, cybersecurity, legal, compliance and other function cross-functional members together as needed throughout the year to consider emerging technologies, such as artificial intelligence and emerging cybersecurity and privacy risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • Our Technology Leadership Team, which includes our group Chief Technology Officer, CISO, Technology Vice Presidents, and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives on a monthly cadence. • Our Senior Leadership Team including IT, operations, risk, legal and compliance leaders across business segments, meet quarterly to manage risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, these leaders review the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. • The Crisis Incident Management Team, which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Annually, this team assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options.

companyName: Shutterstock, Inc.

ticker: SSTK


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity. The Board conducts an annual review of the Company's cybersecurity posture and risk management strategies to identify areas for improvement and maintain alignment with the Company's overall risk management framework.

companyName: Energy Services of America CORP

ticker: ESOA


text: Our board of directors (Board) oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer (CISO) and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the Audit Committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and as otherwise needed, and are available to address any questions or concerns raised by our Board on risk management and any other matters.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Our ERM management committee is responsible for providing input and oversight on our ERM program, including cybersecurity risks. Our ERM management committee is comprised of senior leaders, including our Chief Innovation Officer, with responsibility across operations and core business functions, and with a breadth of knowledge, influence and experience covering the risks we face. An annual report on our enterprise risks, including cybersecurity risks, is presented to the Audit Committee and/or the full Board of Directors (Board).

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: The complexity and evolving nature of cybersecurity threats requires that we engage with a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, to be confident that our cybersecurity strategies and processes are consistent with industry best practices. Our collaboration with these third-parties includes regular threat assessments and consultation on security enhancements.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We did not experience a material cybersecurity incident during the year ended December 30, 2023; however, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: DIXIE GROUP INC

ticker: DXYN


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages our day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Steele Creek Capital Corp


text: The Committee receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Committee, as necessary, regarding any significant cybersecurity incidents. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: The committee convenes on a quarterly basis to discuss the current state of cybersecurity affairs, subsequently reporting their findings to the CEO and CFO.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: To respond to the threat of security breaches and cyberattacks, we maintain a cybersecurity program designed to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, LP. This program includes mechanisms to monitor and detect unusual network activity, cybersecurity incident response and containment tools, and a response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees receive training and are tested routinely through simulated phishing attempts.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including the escalation process for alerting senior management of high severity incidents.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and the board of directors to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 17 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).

companyName: Bark, Inc.

ticker: BARK


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of our enterprise risks, including cybersecurity and other information security risks. The Committee oversees management's implementation of our cybersecurity risk management program. Also, we created a Risk Management Working Group which meets no less than quarterly and which receives updates on our cybersecurity risk management program and cybersecurity risks from the Chief Information Security Officer ("CISO"). The Risk Management Working Group includes two Audit Committee members, certain members of senior management and the CISO.

companyName: Intapp, Inc.

ticker: INTA


text: The audit committee of our board of directors oversees cybersecurity risk and ensures timely reporting and management of these threats.

companyName: ARGAN INC

ticker: AGX


text: Role of Management The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer ("CDIO"), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks. The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies. Cybersecurity risks are included in the Company's ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds. Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team.

companyName: Garrett Motion Inc.

ticker: GTX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, phishing simulation exercises, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.

companyName: NeuroPace Inc

ticker: NPCE


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We maintain cybersecurity insurance coverage that provides protection against potential losses arising from certain cybersecurity incidents. In addition, we have developed the following processes as part of our strategy for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Strive, Inc.

ticker: ASST


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data.

companyName: EXAGEN INC.

ticker: XGN


text: On a quarterly basis, or more often as applicable, any cybersecurity incidents are summarized and reported to the Audit Committee of the Board of Directors which cover any identified cybersecurity incidents, results of third-party vulnerability testing, and key developments in policies. Management's Role Managing Risk The Company's cybersecurity risk management is managed by the President and Chief Financial Officer.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: Our CIO receives reports on cybersecurity threats from experienced information security personnel and third-party consultants and resources, and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team. Additionally, we have a set of Company-wide policies and procedures regarding cybersecurity matters, which include an Information Security best practices intranet site, as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to email usage, remote network access, internet usage, passphrase usage, information technology acceptable use, data governance and privacy, and information security. These policies go through an internal review process and are approved by appropriate members of management. We periodically conduct penetration and vulnerability testing, data recovery testing, and security audits. We also conduct regular employee training on cybersecurity.

companyName: NPK International Inc.

ticker: NPKI


text: Monitoring and Incident Response The CSRI division of the Information Security team is responsible for the operation of LNC's internal Security Operations Center ("SOC"), which performs monitoring and alerting for security events 24 hours a day, 7 days a week, 365 days a year. The CSRI division also actively seeks out cybersecurity threats that might affect the organization and/or our customers. The CSRI team is a component of LNC's formal security incident response team ("SIRT") and process. In addition to the Information Security team, the SIRT also includes representatives from LNC's legal and compliance teams (including Privacy), office of business resiliency, chief risk office, corporate communications, as well as the information technology team. While the CSRI division is responsible for cybersecurity responses generally, should a critical event arise, such an event would be raised to and addressed by the SIRT.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Sirius XM Holdings, as a separate publicly traded company from Liberty, operates its own cybersecurity function. While primary oversight for Sirius XM Holdings rests with its board of directors and Audit Committee, we receive regular reporting from Sirius XM Holdings management and collaborate with those tasked with oversight to ensure risks are appropriately addressed.

companyName: Liberty Media Corp

ticker: FWONA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel and certain cybersecurity service providers.

companyName: Landos Biopharma, Inc.


text: Management is responsible for assessing and managing material risks from cybersecurity threats with leadership from the Company's Vice President – Chief Digital and Information Officer ("CDIO"), who is responsible for the Company's global Digital, Information Technology and Cyber Security organization. Our CDIO has served in various roles in information technology and information security for approximately 20 years with Fortune 500 companies. Our CDIO holds Bachelor of Science and Master of Science degrees in Computer Engineering. He has also completed other advanced leadership training and coursework regarding cybersecurity risk management. Our CDIO reports directly to the Chief Executive Officer.

companyName: Parker-Hannifin Corp

ticker: PH


text: In order to inform the Audit Committee of the planning and execution of our cybersecurity program, several different reports are provided from management.

companyName: Zumiez Inc

ticker: ZUMZ


text: JFI's Board of Directors receives periodic reports from its Finance and Risk Committee regarding the committee's actions in respect of cybersecurity and related regulatory developments and receives from our CISO regular updates about cybersecurity threats and our cybersecurity and privacy programs.

companyName: Jackson Financial Inc.

ticker: JXN


text: As of December 31, 2024, the Company has not identified any cybersecurity threats, including previous incidents, that have materially impacted our business strategy, results of operations, or financial condition. This assertion signifies our diligent efforts in managing and mitigating cybersecurity risks, contributing to the stability and continuity of our operations.

companyName: Intelligent Hotel Group Ltd.

ticker: ZHJD


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from the cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: Role of the Board of Directors and the Audit Committee Our Audit Committee has responsibility for overseeing and reviewing our cybersecurity, data privacy, and other information technology risks, controls and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches. Our Audit Committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls and disclosure procedures and any public disclosures about our cybersecurity controls and procedures, the Board of Directors' cybersecurity expertise, and its oversight of cybersecurity risk. The Audit Committee periodically reports on its review of cybersecurity risks and our cybersecurity program to our Board of Directors. In 2024, our CISO or his team met with the Audit Committee four times to discuss cybersecurity risks and threats.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Cybersecurity is an integral part of risk management at our company. Cybersecurity is overseen by LTC's Board of Directors (the "Board") and the Audit Committee of the Board (the "Audit Committee"), along with subject matter experts serving our company including our information technology director. Pursuant to its charter, the Audit Committee has the responsibility and duty to review and discuss with management on a regular basis our company's programs, policies and procedures related to information security and data protection, including data privacy and network security, as they relate to financial reporting. The Board and the Audit Committee receive reports on cybersecurity from management at least quarterly and more often as needed. These reports on cybersecurity typically encompasses the nature and threats, defense and detection capabilities, and training activities at our company.

companyName: LTC PROPERTIES INC

ticker: LTC


text: Organization and Management To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, J.P. Morgan maintains an Information Security Program designed to prevent, detect and respond to cyberattacks. In addition, the Adviser leverages J.P. Morgan's cybersecurity incident response plan ("IRP"), which is designed to enable us, the Adviser and its affiliates to respond to attempted cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify stockholders, clients, and customers, as applicable.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Senior Vice President, or SVP, of Chemistry and Manufacturing, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the SVP of Chemistry and Manufacturing as well as to other executive management on cyber matters, as appropriate.

companyName: PepGen Inc.

ticker: PEPG


text: Our information security program is designed to ensure adequate governance, and oversight is in place while evolving to meet changes in applicable laws and regulations, and industry best practices. Cybersecurity is a significant risk to the enterprise and matters related to information security are regularly featured as part of management's enterprise risk profile updates to the Risk Committee of the Board of Directors (the " Risk Committee "), which occur at least on a quarterly basis. The Chair of the Risk Committee reports to the Board of Directors on the committee's proceedings and activities, including in connection with the committee's deliberation on information security matters, on a regular basis. In addition to regular touchpoints on cyber matters at the Risk Committee, the Board of Directors receives briefings from the Bank's Chief Information Security Officer (the "CISO") semi-annually.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Corporation's information technology risk management department consists of professionals with experience and expertise in cybersecurity, including specialists in identity and access management, cyber defense operations, security engineering, and information technology governance, risk, and compliance. This department is led by the Chief Information Officer ("CIO"), who has over 27 years of experience in technology risk management, and the Information Security Officer ("ISO"), who has a bachelor in computer science and has over 18 years of experience in cybersecurity risk management. The ISO reports to the CIO, and the CIO reports directly to the President and Chief Executive Officer. Additionally, the Corporation engages third-party experts as needed to assess, manage, and respond to cybersecurity risks through various methods, including risk assessments, IT audits based on different frameworks, penetration and vulnerability testing, social engineering, incident response, threat intelligence, education, and managed security services.

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: Our security teams engage in threat intelligence, predictive modeling, and penetration testing to understand the Company's threat landscape and reduce the risk and impact of cybersecurity incidents. These teams have established procedures for detecting, managing, and remediating cybersecurity incidents, and processes for personnel to escalate incidents within the organization. A cross-functional working group of security, privacy, and legal personnel review significant incidents to determine if further escalation is appropriate. If an incident could be deemed material, it is escalated, and we consult with outside counsel during this assessment as appropriate.

companyName: Booking Holdings Inc.

ticker: BKNG


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party manager applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party business partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Related to Cybersecurity, Data Privacy, and Information Technology" in our Risk Factors in Item 1A of this Form 10-K.

companyName: STARBUCKS CORP

ticker: SBUX


text: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: Our ability to conduct our business may be impaired, or our customer and employee personal information may be vulnerable, if our IT resources are compromised, degraded, damaged or fail. Such events may include, but are not limited to: a virus or other harmful circumstance; intentional penetration or disruption of our information technology resources by a third party; natural disaster; hardware or software corruption or failure or telecommunications system failure; service provider error or failure; intentional or unintentional personnel actions (including the failure to follow our security protocols); or lost connectivity to our networked resources.

companyName: Meritage Homes CORP

ticker: MTH


text: Cross-functional management engagement We have established a committee comprised of leaders from key functions across the Company including, but not limited to, information security, IT, engineering, legal, privacy, finance, and people operations. Members of this committee generally meet regularly to review the Company's cybersecurity program, the evolving threat landscape and key related action items.

companyName: Outset Medical, Inc.

ticker: OM


text: Material Impact of Cybersecurity Threats While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: CYBERSECURITY RISK MANAGEMENT W e have developed and implemented an Information Security Program for Corebridge (the "Program") that includes, among other things, conducting periodic risk assessments designed to evaluate potential security threats, to detect potential vulnerabilities, and to mitigate identified security risks. The Program is informed by industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of Corebridge's information assets and systems that store, process, or transmit material non-public information. The Program is managed day-to-day by technology, information security, and operational personnel. W here appropriate, we also engage third-parties to provide operational support for the Program and to evaluate our Program and our cybersecurity risk management.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Managing Third Party Risk We also recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and we have processes in place to oversee and manage these risks. We maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity and other IT risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: The Compliance Subcommittee oversees our ERM process, including the management of risks arising from cybersecurity threats. The Compliance Subcommittee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Compliance Subcommittee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a quarterly basis, our Chief Privacy and Compliance Officer and our Information Security Director discuss the Company's approach to cybersecurity risk management with the Compliance Subcommittee.

companyName: UpHealth, Inc.


text: We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Data Breach Response Policy, which includes an Incident Response Plan ("IRP") in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our Chief Financial Officer ("CFO") will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the IRP to guide the response.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Our CISO leads all aspects of our global cybersecurity program, including the identification, evaluation, and prioritization of security risks, as well as the company's response to material security incidents. Our CISO joined Workday in 2010 and has served as our CISO since April 2018. Our CISO has more than 15 years of experience in cybersecurity and information technology risk management, including at a large public company and a recognized consulting firm. He also has a degree in information systems management.

companyName: Workday, Inc.

ticker: WDAY


text: We have a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, Chief Legal Officer, Chief Compliance Officer, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and respond to any significant cyber incidents. The working group is expected to escalate matters of significance to our Incident Response Team, ERMC (defined below) and/or the disclosure committee, as appropriate.

companyName: StepStone Group Inc.

ticker: STEP


text: We maintain a detailed incident response plan to identify, manage, investigate, and remediate various types of cybersecurity incidents. This plan provides organizational and operational structures, processes, and procedures to allow responsible personnel to initiate and execute a proper response to cybersecurity incidents that may affect the function and security of IT assets, information resources, and business operations. The plan describes the processes for cybersecurity incident severity assessment, materiality determination, roles and responsibilities for the incident response team members, and necessary alerts and notifications.

companyName: International Seaways, Inc.

ticker: INSW


text: We leverage the support of third-party information technology and security providers, including to perform penetration testing and threat intelligence analysis. We have previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we have endeavored to adapt our cyber risk strategy to mitigate emerging cybersecurity risks. We implement a multi-layered approach to cybersecurity that includes, for example, employee security awareness training, various security tools and technologies, and incident response planning.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Our Director of Information Security meets with the Audit Committee at least twice a year to discuss our cybersecurity risks, strategy, and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, we have governance and compliance structures that are designed to elevate issues relating to cybersecurity to executive o cers, and, as appropriate, to the Audit Committee and Board.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: processes to identify and respond to material cybersecurity risks from third party service providers, and risk mitigation policies to reduce exposure to such risks. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.

companyName: AerSale Corp

ticker: ASLE


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure in our information technology, telephone or other systems could significantly disrupt our operations and adversely affect our business and financial condition," which disclosures are incorporated by reference herein.

companyName: EXAGEN INC.

ticker: XGN


text: Backup Data Storage. We have both internal and external third-party backup data storage to help protect our data from cybersecurity incidents. We test our backup restoration process on a regular basis.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Management's Involvement in Cybersecurity Risk Oversight Officers of the Wind-Down Entity are responsible for establishing the policies, standards, and requirements for the security of computing and network environments, protecting against the risk of unauthorized access by monitoring potential security threats, and overseeing the execution of corrective actions, including third party vendor compliance. The Company has engaged a third-party IT provider to manage our internal network and provide cybersecurity incident prevention and detection. This IT provider is an audit certified vendor (CISA) that evaluates and advises management on cybersecurity issues.

companyName: Woodbridge Liquidation Trust

ticker: WBQNL


text: Our board of directors is aware of the critical nature of managing risks associated with cybersecurity threats. In recognition of the significance of these threats to our operational integrity and shareholder confidence, our board of directors has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Senior Director of IT who has over 25 years of experience as an IT professional engaged in network cybersecurity. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: The Company's Information Security and Privacy teams reduce first and third-party risk by maintaining a proactive security posture aligned with current threats, detecting cybersecurity events and responding quickly, and building procedures to rapidly recover. These teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Senior Information Officer (SIO). We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.

companyName: Investview, Inc.

ticker: INVU


text: Consulting with external advisors and specialists on specific projects regarding opportunities and enhancements to strengthen our cyber practices and policies on an as needed basis;

companyName: TopBuild Corp

ticker: BLD


text: Third Party Risk Management We leverage multiple third parties to support our business operations. Throughout the lifecycle of the vendor relationship, security is integrated as part of each process. We maintain a vendor inventory, categorized based in risk tiers, and perform due diligence of the vendor's security practices commensurate with the risk tier. Vendor contracts and security practices are monitored to ensure an accurate assessment of risk is maintained.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Cyber-awareness training and testing is a key component of RadNet's Cybersecurity and Data Protection Program. Every employee is required to complete cyber-related training (including third-parties who access our systems) and successfully complete testing throughout the year in addition to monthly phishing tests. Furthermore, we require all system users to complete annual Patient Privacy and Patient Data Breach training and testing to meet RadNet compliance standards.

companyName: RadNet, Inc.

ticker: RDNT


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our Head of Information Security and Compliance and the InfoSec Team, in partnership with our Legal Privacy Team, oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Head of Information Security and Compliance and the InfoSec Team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their implementation and oversight of safeguards, including through the use of automated tools and manual processes, like security event monitoring, vulnerability scanning, threat analytics, security awareness and training, endpoint security, bug bounty program, offensive security testing, and third-party risk and monitoring.

companyName: AppLovin Corp

ticker: APP


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CIO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CIO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.

companyName: KROGER CO

ticker: KR


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight. Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: Our incident response program consists of an Incident Response Plan document and a cross-functional Incident Response Team, which are defined in our Information Security Policies. All workforce members are trained on incident reporting procedures, and there is a single point of contact for reporting all incidents. Incident response training is conducted annually, followed by a tabletop exercise. Our Incident Response Plan instructs personnel on how to notify our Incident Response Team in case of an incident. The VP of Information Security is the point person for incident responses and coordinates mitigation and remediation of cybersecurity incidents. We log all incidents and response plans for purposes of internal documentation. We report critical incidents to the management team, the Audit Committee, and the Board of Directors.

companyName: OptimizeRx Corp

ticker: OPRX


text: Pence brings a wealth of expertise to his role. His background includes experience as an enterprise CISO and his knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our cybersecurity efforts and governance programs, tests our compliance with standards, remediates known risks, and provides regular guidance to management and the Board on these areas. In addition, to supplement this expertise, we periodically engage external experts, including cybersecurity consultants, to help us evaluate our risk management related policies and to help us to review and remediate cybersecurity incidents.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: To effectively identify, assess and manage risks from cybersecurity threats, the Company maintains a cybersecurity and cyber risk management program which is comprised of the Company-wide cybersecurity strategy and its supporting policies, processes and architecture. This program is part of the Company's enterprise risk management program.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: During the fiscal year ended December 31, 2024, the Company has not identified any specific risks from cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company's business strategy, results of operations, or financial condition, other than the risks described under "Risk Factors – Operations and Business Risk" in the 2024 Annual Report. The Company may not be successful in preventing or mitigating the impacts of a future cybersecurity incident that could have a material adverse effect on the Company or its business strategy, results of operations or financial condition.

companyName: US BANCORP \DE\

ticker: USB


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information systems have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: In the United Kingdom, data protection is governed by the UK General Data Protection Regulation 2016/679 and the UK Data Protection Act of 2018 (together the "UK GDPR"), which requires companies to manage the access and transfer of personal information of UK residents. The Company's affiliates licensed and doing business in the UK are subject to compliance with the provisions of the UK GDPR.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: The Company's CISO has over 15 years of prior work experience, which includes managing information security and operational risk, developing cybersecurity strategy and incident responses, implementing effective information and cybersecurity programs, preventing fraud and social engineering, and ensuring business continuity and proper third party management. The Company's CTO has over 25 years of prior work experience in cybersecurity and data center management and design, 16 years of which has been devoted to the financial and banking sectors. The Enterprise Technology Department is comprised of a team of subject matter experts in security operations, network architecture, cyber and information security governance and cybersecurity/network operations.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, notwithstanding our processes, policies and procedures designed to monitor and mitigate the risks of cybersecurity threats, there can be no assurance that we or third parties with which we interact will not experience a cybersecurity incident that materially affects us in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. See "Risks Related to Technology" in "Risk Factors" of this Form 10-K.

companyName: HIBBETT INC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches and improper access to or disclosure of our data or user data, or other hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business" included within Item 1A of this Annual Report on Form 10-K. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial.

companyName: TrueCar, Inc.


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the "Technology Committee") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management process managed by the Chief Risk Officer through reporting of cyber risks to the Information Security Steering Committee (ISSC). The cybersecurity risk management processes will be transitioned under the Chief Information Officer's division for the 2025 year. The ISSC is chaired by the Managing Director of Information Security, who has 18 years of information technology (IT) and information security experience in the financial services industry. Key metrics are monitored on an ongoing basis by the IT Risk Management and IT Security teams, with oversight by the ISSC. IT Risk Management performs regular information security-focused risk assessments, including but not limited to assessments based on the Center for Information Security Controls Self-Assessment Tool and Ransomware Self-Assessment Tool aligned to the Federal Financial Institutions Examination Council standards.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: Information Security Incident Responses. The Bank maintains information security incident response plans for various information security/data breach scenarios. The Bank tests its incident response plans at least annually. Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement. For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general public unless required by law or as directed by applicable lawful authority.

companyName: BankFinancial CORP


text: For further discussion of the risks associated with cybersecurity incidents, see our "Risks Related to Cybersecurity, Data Privacy and Information Technology" under "Risk Factors."

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Risk Management and Strategy Assessing, identifying and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program..

companyName: BANK OF HAWAII CORP

ticker: BOH


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the enterprise risk management processes and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management processes.

companyName: RELIANCE, INC.

ticker: RS


text: We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified. We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents.

companyName: JBG SMITH Properties

ticker: JBGS


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and administers its cybersecurity risk oversight function through the Audit Committee. The Audit Committee receives quarterly updates on our enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires also receive training in response to drills and simulated attacks.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees the Company's cybersecurity risk profile, including risks from cybersecurity threats, and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company, and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Corporation also monitors risks from third parties, such as service providers, through efforts like monitoring, information sharing, risk assessments, audits, contractual due diligence, and adherence to third-party security standards. Senior management governs risk management and is informed about and monitors the prevention, detection, mitigation, and mediation of cybersecurity incidents. This is facilitated through working review committees, on which the ISO and/or CIO serve. These committees receive risk management reports appropriate to their scope of review, covering assessment results, risk ratings, and critical issues. They report significant matters to enterprise-wide risk committees, which oversee the broader scope of risk management for the enterprise. Through these efforts, senior management makes decisions and sets priorities for allocating resources to address risk management issues.

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: To strengthen our cybersecurity readiness, we have developed a cybersecurity incident management process that incorporates the use of third-party IT resources. Our cybersecurity incident response plan is intended to promptly identify, evaluate, respond, remediate and recover from cybersecurity incidents through the preparation, detection, analysis, communication, eradication and containment of such incidents, including those associated with third-party service providers. The identification, assessment and response functions related to information security are managed by an internal incident response team, which is responsible for maintaining and operationalizing our incident response plan. Key components of our cybersecurity incident management process and response plan include root cause analysis when incidents occur, tabletop exercises and implementation of business continuity and disaster recovery plans.

companyName: PRA GROUP INC

ticker: PRAA


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties with whom we work, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Government Regulation and Litigation — Our information technology infrastructure and information are vulnerable to service interruptions, data corruption, cyber-based attacks, or network security breaches, which could result in the disruption of operations or the loss of data confidentiality."

companyName: Enovis CORP

ticker: ENOV


text: The Chief Operating Officer of ExchangeRight (the "COO") oversees our information security team, which is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The COO has information technology and program management experience, and has served many years overseeing our information security strategy. The information security team manages and continually enhances an enterprise security structure with the ongoing goal of mitigating cybersecurity risks to the extent feasible, while increasing our system resilience in an effort to minimize any potential business impact. Employees outside of our information security team also have a role in our cybersecurity defenses, and they are immersed in a corporate culture committed to security.

companyName: ExchangeRight Income Fund


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: We are not aware of any risks from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: U. S. Premium Beef, LLC


text: Company's cybersecurity risk management program is supervised by our Senior Manager of Information Security (SMIS), who reports directly to the Company's Chief Operating Officer ("COO") in Pakistan. The SMIS and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current SMIS received his bachelor's in computer sciences and has over 20 years of cybersecurity experience, including relevant prior senior leadership experience at our Company. Furthermore, he has also achieved globally recognized information security certifications, including CISSP (Certified Information Systems Security Professional), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CompTIA Security+, ISO 27001 Lead Auditor, CEH (Certified Ethical Hacker), CHFI (Computer Hacking Forensic Investigator), among others.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: RadNet's Cybersecurity and Data Protection Program assesses, identifies and manages threats to our information systems and evaluates cybersecurity risks associated with our vendors and third-party partners. We are focused on detecting, preventing and responding to cyber threats, maintaining the privacy and protection of sensitive information, and maintaining the durability and resiliency of our information and data processing systems.

companyName: RadNet, Inc.

ticker: RDNT


text: Our CISO, and where necessary our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, through our security incident response process. We maintain internal aliases, which employees may use to identify a cybersecurity or privacy threat or incident, for escalation, investigation, containment, and remediation. A report to the alias triggers our Security Incident Response Policy and associated plans, which has defined roles for our cross-functional incident response team. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to our management team by our CISO and General Counsel (or their designees) and escalations of certain cybersecurity incidents as appropriate to our board of directors. If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.

companyName: Snap Inc

ticker: SNAP


text: Monitoring Cybersecurity Incidents The VPIT stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The VPIT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VPIT is equipped with a well-defined, robust incident response plan. This plan includes immediate actions to mitigate the impact, report the incident, if required, and develop and implement long-term strategies for the remediation and prevention of future incidents.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Verint's cybersecurity program is overseen by our Chief Information Security Officer ("CISO"), whose team is responsible for managing and executing on our cybersecurity strategy, policy, standards, architecture, and processes, including as described above. Our CISO has over 25 years of leadership experience in IT and cybersecurity and maintains an industry leading cybersecurity certification. Verint's overall cybersecurity team holds relevant skills training and certifications based on their specific focus areas, such as security operations, cyber risk management, and data security. Our cybersecurity team is regularly trained to combat current and emerging threats. Verint maintains and operates a 24x7 security operations center "SOC" that monitors all aspects of our security infrastructure. Verint's SOC executes our security incident response plan inclusive of identification, mitigation, remediation, and recovery processes. These processes govern assessment of materiality and impact, along with management of communications, response, and recovery plans. Our CISO reports to our Chief Administrative Officer ("CAO") and provides regular reports on our cybersecurity program to the CAO and other members of our senior management team.

companyName: VERINT SYSTEMS INC


text: The Company's President and Chief Information Officer, who has over a decade of experience leading information and cyber security oversight, is responsible for developing and implementing our information security program, overseeing our IT team and reporting on cybersecurity matters to the Technology and Innovation Committee. We view cybersecurity as a shared responsibility, and we consult with third-party resources and advisors as needed on information security maturity assessments, penetration testing, dark web reviews, best practices to address new challenges, and, when applicable, digital forensics. All employees are required to complete annual information security trainings and have access to more frequent online information security trainings.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts and internal threat intelligence team. A team of dedicated privacy, safety, and security professionals oversees cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Leadership of this team includes professionals with deep cybersecurity expertise, including our Chief Information Security Officer. Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: DarioHealth Corp.

ticker: DRIO


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;

companyName: TMC the metals Co Inc.

ticker: TMC


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information security team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Despite ongoing threats like cyber-attacks, phishing, and ransomware, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Our proactive security measures, alongside those of our third-party vendors, aim to protect our information technology systems and the sensitive data they hold. Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.

companyName: Inogen Inc

ticker: INGN


text: Engage Third-parties on Risk Management, as required Recognizing the complexity and evolving nature of cybersecurity threats, the Company plans to engage external experts, including cybersecurity assessors and auditors in evaluating and testing our risk management systems. These partnerships would enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our possible collaborations with these third-parties will innclude regular audits, threat assessments, and consultation on security enhancements.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions. J.P. Morgan has implemented measures and controls reasonably designed to address this evolving environment, including enhanced threat monitoring. In addition, J.P. Morgan continues to review and enhance its capabilities to address associated risks, such as those relating to the management of administrative access to systems.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Our commitment to cybersecurity is a fundamental aspect of our operational strategy, ensuring the protection of our information assets, the continuity of our operations, and the trust of our stakeholders.

companyName: Outdoor Holding Co

ticker: POWW


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Interim CEO/Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: The Company's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTTO and our Vice President IT Risk Management. The Company's CTTO works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. To facilitate the success of the Company's cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty. Reporting to our Vice President IT Risk Management are a number of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Ulta Beauty, Inc.

ticker: ULTA