text: The Sarbanes-Oxley & Cybersecurity Steering Committee, in coordination with the Company's outside legal counsel, works collaboratively across the Company and with various consultants to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Vice President of Information Technology has served in various roles in information technology and information security for over 25 years and holds undergraduate and graduate degrees in computer science. As described in more detail above under the heading "Information about our Executive Officers," the Company's Chief Executive Officer and the President and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 30 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Security Risk Management LiveRamp also maintains a security risk management program overseen by our CISO and aligned with the Company's overall Enterprise Risk Management strategy. The security risk management program includes processes for consistently identifying, classifying, analyzing, and documenting risk. Throughout the year, LiveRamp's security team conducts risk assessments focused on a particular product or compliance scope. Risks are documented and communicated to relevant stakeholders. In addition to internal teams and resources, LiveRamp leverages a variety of third parties in support of our security risk management efforts. Third-party managed services are used to support functions including our Security Operations Center, forensic incident response, and incident response tabletop exercises. Third-party providers are also utilized for penetration testing and for a bug bounty program. Third-party tooling is utilized in support of functions including threat intelligence, security logging, security information and event management (SIEM), vulnerability scanning, email protection, security awareness training, secure development training, cloud posture management, secret management, identity and access management, and anti-malware. Furthermore, following the shared responsibility model with our cloud service providers, we rely on their implementation of certain security controls, such as physical security.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP

secItem: Item 1C


text: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We have no t identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors have experienced threats relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Fintech Scion Ltd


text: The Corporation has developed an information security program to assess, identify, and monitor cybersecurity risks. The Corporation regularly assesses cybersecurity risks arising from the operating environment and attempts to identify the likelihood and severity of the risk and the possible impact of the risk on the Corporation, its customers, and employees.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Governance of cybersecurity risk management Our Board of Directors, acting through the Audit Committee, is responsible for overseeing management's implementation and execution of the risk management process, including our cybersecurity risk management strategy and processes. Our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: Our cybersecurity risk management is primarily the responsibility of our Vice President and Chief Information Officer and the information technology teams he leads. Our Vice President and Chief Information Officer has 25 years of industry experience in the field of information systems, including information security and risk management. He oversees our risk assessment programs, remediation of known risks, processes for the regular monitoring of our information systems and our employee cybersecurity training programs. Our Board of Directors also oversees cybersecurity risks through the Audit Committee, which receives and assesses periodic reports and updates regarding our cybersecurity risk management from management and our Vice President and Chief Information Officer and then relays them to the Board of Directors as needed.

companyName: Permian Resources Corp

ticker: PR


text: Our Enterprise Risk Management governance structure is based on the principle that each line of business is responsible for managing risks, including information security risk, inherent in its business.

companyName: Discover Financial Services


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and related mitigation activities are also subject to oversight by the Audit Committee of our Board of Directors. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks, including management's response to any significant cybersecurity incidents. The Audit Committee receives regular reports, from our interim CISO and Chief Technology Officer, regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items, and reports to the Board of Directors at least quarterly.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: As a foundation of this approach, we have implemented a layered governance structure to help assess, identify, manage and report cybersecurity risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST"), which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. To protect our network and information systems from cybersecurity threats, we use various security tools and policies that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: Gogo Inc.

ticker: GOGO


text: Board of Directors' Roles and Responsibilities Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are continually monitored by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the Risk Oversight Committee ("ROC") of our Board of Directors. The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.

companyName: Science Applications International Corp

ticker: SAIC


text: The risks from cybersecurity threats have not to date materially affected us or not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in the healthcare industry that handle protected health information and companies in all industries that rely on technology to run their operations, a material cybersecurity incident could potentially impact our results of operations and financial condition.

companyName: agilon health, inc.

ticker: AGL


text: Based on the insights gleaned from these assessments, audits, and reviews, we dynamically adjust and refine our cybersecurity policies, standards, processes, and practices to continuously enhance our cybersecurity posture.

companyName: WIDEPOINT CORP

ticker: WYY


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.

companyName: ServiceNow, Inc.

ticker: NOW


text: The Board, in coordination with the Audit Committee, oversees the Company's policies with respect to the assessment and management of risks from cybersecurity threats. The Board and Audit Committee receive regular updates regarding cybersecurity risks from the Company's Chief Information Security Officer (CISO) and Chief Information Officer (CIO), including with respect to the assessment and management of such risks and recent developments, trends and the general threat environment.

companyName: PHINIA INC.

ticker: PHIN


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring: We work to protect our business from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and review trends in the data. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and enhanced based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. • Information Sharing and Collaboration: We share and receive threat intelligence and best practices with industry peers, government agencies, information sharing and analysis centers, industry trade organizations, and cybersecurity forums. These relationships enable the rapid sharing of information around threat and vulnerability mitigation. • Third-Party Risk Assessments: We engage third-party services to conduct assessments of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These assessments include testing both the design and operational effectiveness of security controls. • Companywide Policies and Procedures: We have companywide cybersecurity policies and procedures, such as encryption standards, antivirus protection, remote access protocols, multi-factor authentication, protection of confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process and are approved by the appropriate members of management. • Training and Awareness: We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees routinely participate in phishing campaigns, education that reinforces compliance with our policies, standards and practices, and other awareness training. We also periodically perform simulations and other exercises with management and incorporate external resources and advisors as needed. Our team of cybersecurity professionals collaborate with stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. • Supplier Engagement: We work collectively with our suppliers to support cybersecurity resiliency in our supply chain. The Company uses a variety of processes to address third-party cybersecurity threats, including reviewing the cybersecurity practices of such provider(s), contractually imposing obligations on the provider(s), notifications in the event of any known or suspected cyber incident, conducting security assessments, and periodic reassessments during the course of the Company's engagement with such provider(s).

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: This risk management approach informs decision-making processes related to the company's strategic priorities, the allocation of resources, and the establishment of oversight mechanisms. The governance of this program resides with our Board of Directors, which bears the ultimate responsibility for the oversight of cybersecurity risks. Supporting the Board, the Audit Committee plays a pivotal role by engaging in regular reviews of our cybersecurity efforts in collaboration with management and providing periodic updates to the Board. These assessments are conducted at least quarterly, with additional sessions convened as needed to address emerging issues or refine strategies.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Incident response plan to ensure swift, effective and accurate disclosure of cybersecurity incidents to the appropriate employees of the Company, as well as our Board of Directors, if applicable.

companyName: JANEL CORP

ticker: JANL


text: Our Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives an annual briefing from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Chief Technology Officer ("CTO") and the Senior Director of Information Security.

companyName: Warby Parker Inc.

ticker: WRBY


text: The Company has a robust cybersecurity program that has direct involvement from the Board of Directors and senior management. Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business.

companyName: DIODES INC /DEL/

ticker: DIOD


text: The Board has the primary responsibility for overseeing and reviewing the guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Board receives periodic updates from the Fund's management regarding TIAA's cybersecurity program, information on current threat landscape and risks from cybersecurity threats and cybersecurity incidents impacting the Fund.

companyName: Nuveen Churchill Private Capital Income Fund


text: As of the date of this Annual Report, we believe that we have limited risks associated with a breach in cybersecurity. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (of which we are not aware of any), have not materially affected or are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: GLOBAL LEADERS CORP

ticker: GLCP


text: Our risk and vulnerability management program encompasses both proactive and predictive defenses. We regularly assess, remediate, and validate our security measures to address emerging threats and vulnerabilities. This includes conducting vulnerability scans, penetration testing, and threat intelligence analysis.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: Failures in, material damage to, or interruptions in our information technology systems, including as a result of cyber-attacks, and difficulties in updating our existing software or developing or implementing new software, could have a material adverse effect on our business or results of operations. We depend increasingly on our information technology systems in the conduct of our business. For example, we own, license or otherwise contract for technology and systems to do business with customers, including for order entry and fulfillment, processing and payment, product shipping and product returns. We also maintain internal and external communications, product inventory, supply, production and enterprise management, and personnel information on information systems. Our information systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, security breaches and natural and man-made disasters. In particular, from time to time we and third parties who provide services for us experience cyber-attacks, attempted breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or customer information, systems interruption or the disruption of our operations. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and may be difficult to detect for long periods of time, and accordingly we may be unable to anticipate and prevent all data security incidents. Like many businesses, our systems come under frequent attack from third parties. We are required to expend capital and other resources to protect against such cyber-attacks and potential security breaches or to alleviate problems caused by such potential breaches or attacks. Despite the constant monitoring of our technology systems and hiring of specialized third parties to identify and address any vulnerabilities through implementation of network security measures, it is possible that computer programmers and hackers, or even internal users, may be able to penetrate, create systems disruptions or cause shutdowns of our network security or that of third-party companies with which we have contracted. As a result, we could experience significant disruptions of our operations and incur significant expenses addressing problems created by these breaches. Such unauthorized access could disrupt our business and could result in a loss of revenue or assets and any compromise of customer information could subject us to customer or government litigation and harm our reputation, which could adversely affect our business and growth.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: The Board of Directors has oversight responsibility for cyber risks affecting the Company. The Board has delegated risk oversight of operational, compliance, and financial matters, including cybersecurity and information technology risk, to the Audit Committee.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Board of Directors The Board of Directors ("the Board") has delegated the primary responsibility to oversee risks from cybersecurity threats to the Audit Committee. The Board and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The Board and Audit Committee are updated on a quarterly basis by Vice President, Corporate Services on the Company's internal information technology ("IT") security testing, any unauthorized attempts to access the Company's network, any significant developments in cyber security risks and threats, and updates on the Company's policies and procedures for protecting the Company's data. We also have processes by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit Committee. All incidents are reported to the Executive Officers (including the President and Chief Executive Officer, Chief Financial Officer and the Chief Operating Officer) who assess the severity and what measures and procedures are necessary.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: Cybersecurity Risk Management and Strategy Riley Permian recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, harm to our employees, suppliers or industry partners, intellectual property theft, fraud, extortion, and violation of data privacy or security laws. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices for identifying and managing cybersecurity risks within our operations, infrastructure and corporate resources.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our ISO. The ISO works with our CSIRT to help us mitigate and remediate cybersecurity threats or incidents of which they are notified. The ISO is responsible for designing and promoting general security awareness and training, as well as defining and training relevant participants on our incident response processes. Our security and incident response processes include escalation and reporting to the CSIRT, Disclosure and Risk Committee, senior management and Audit Committee for certain information security incidents, as warranted under the circumstances.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our cybersecurity incident response program is designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our CIO, CISO, General Counsel, Division Presidents, CFO and/or Chief Executive Officer (collectively, "Senior Management") and, in the instance of product cybersecurity incidents, our E-Systems Safety Committee. Senior Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response program includes reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.

companyName: LEAR CORP

ticker: LEA


text: Enterprise Risk Management. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our Enterprise Risk Management ("ERM") program. Our ERM program, which is coordinated through our Enterprise Risk and Internal Audit function ("ERAS team"), includes the identification of risks relevant to Teradata's business, including material risks from cybersecurity threats; assigning personnel responsible for such risks; the development of strategies and plans to monitor, assess, and mitigate such risks; and oversight of the identified risks through regular reporting and risk evaluations with management, our Board, and/or relevant Board committee. Our ERAS team works closely with the Information Security function, including our Chief Information Security Officer ("CISO"), in the cybersecurity risk management process that informs the ERM program.

companyName: TERADATA CORP /DE/

ticker: TDC


text: During the year ended September 30, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Collab Z Inc.

ticker: CLBZ


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed, and the audit committee reports to the Board.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: Our Director of Information Technology has responsibilities which include preventing and monitoring cybersecurity threats and utilizes the assistance of external vendors in this effort. Our Director of Information Technology regularly reports to senior management regarding the status of our cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of our cybersecurity profile.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: We maintain written policies and procedures that outline the Company's comprehensive information security program (CISP). The Chief Information Security Officer (CISO) has the responsibility for implementation and maintenance of the CISP. In addition to SEC and FINRA regulatory requirements, we leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to continually improve our policies and procedures. In addition, our employees are required to complete a cybersecurity training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational notifications.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: Given the nature of our operations and size, we may be more susceptible to cybersecurity threats. We acknowledge the possibility of breaches or unauthorized access to our systems, which could result in the loss or compromise of sensitive information. Any such incident could have a material adverse effect on our business, financial condition, and reputation.

companyName: FLEXPOINT SENSOR SYSTEMS INC

ticker: FLXT


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis.

companyName: Zeo Energy Corp.

ticker: ZEO


text: The cybersecurity risk committee receives regular updates from Okta's chief security officer (the "CSO") on our cybersecurity program. In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. The cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, the board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board receives cybersecurity updates as part of the audit committee's oversight of Okta's enterprise risk management program.

companyName: Okta, Inc.

ticker: OKTA


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Duke Energy's first line of defense is the CIRT under the Office of the Chief Administrative Officer (CAO). The CIRT reports up to leaders in the Chief Security and Information Security Office, including the Chief Security and Information Security Officer (CSISO), Managing Director of Cybersecurity and Network Defense, and Director of Cybersecurity Operations, whose cybersecurity backgrounds include many years serving in operational cyber roles, leading incident response, participating in industry engagement, collaborating with federal and local cyber programs, and time analyzing security breaches across the industry. The CIRT oversees an enterprisewide process that identifies, assesses, responds to and resolves cyber incidents, both internal and those associated with the Company's use of third-party service providers, by defining roles, responsibilities and the process for problem source identification, mitigation, and eradication triggered by a suspected cyber incident. Duke Energy manages cybersecurity threats through its 24/7 Duke Energy Cybersecurity Operations Center (CSOC), which serves as the Company's central command center for monitoring and coordinating responses to cyber-threats. The CSOC engages in daily information sharing within the utilities industry and with government partners and monitors incoming intelligence and cyber incident impacts. The CSOC assesses the relevant information by assigning a CIRT Heat Map score, which results in CIRT activation if a certain threat level is met. It also results in the assignment of additional roles and responsibilities to enable the cybersecurity leadership and technical teams to collectively and regularly review incident information, score the impact, communicate to leadership, and respond appropriately. Another key component of Duke Energy's first line of defense against cybersecurity threats is its Third-Party Risk Management (TPRM) process, whereby third parties providing services that meet certain criteria such as storing or transmitting Duke Energy data, hosting an application, or connecting to the Duke Energy network are required to undergo a cybersecurity assessment primarily to ascertain the risk of a third-party's proposed services to Duke Energy.

companyName: PROGRESS ENERGY INC


text: Engagement of Third Parties Given the complex and quickly evolving nature of cybersecurity threats, we engage third-party advisors to assist our team in developing and maintaining effective cybersecurity risk management. Partnering with external entities allows us to leverage specialized knowledge and insights, better ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2025 we engaged a global cybersecurity leader to conduct an external assessment of our Information Security program, which included consideration of the cybersecurity framework, organizational structure and collective capabilities.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Although the risks from cyber threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. For a detailed description of the risks related to cybersecurity, see Item 1A. "Risk Factors." of this Annual Report, which should be read in conjunction with this Item 1C.

companyName: TUCOWS INC /PA/

ticker: TCX


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. – Management's Role in Assessing and Managing Material Cybersecurity Risks:

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Notwithstanding our defensive measures and processes, the threats posed by IT failures and cyber-attacks are always present. The potential impact of risks from IT incidents, including whether such IT incidents may be associated with cybersecurity threats to the Company, is assessed on an ongoing basis.

companyName: Freedom Holding Corp.

ticker: FRHC


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.

companyName: SolarWinds Corp


text: As part of our incident detection and response processes, we have established internal teams to investigate and escalate notification of cybersecurity incidents. Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within First Advantage (including the interim CISO, Chief Financial Officer, and Chief Legal Officer) and to the Audit Committee and Board of Directors based on incident materiality. We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified. On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our interim CISO, and our Chief Legal Officer. We maintain cybersecurity insurance, which provides coverage for certain costs related to cybersecurity incidents.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our board of directors has delegated oversight of our company's cybersecurity risk management to our audit committee. The audit committee, pursuant to the audit committee charter, is responsible for reviewing our company's information security and technology risks (including cybersecurity), including high-level review of the threat landscape facing our company and our company's strategy to mitigate cybersecurity risks and potential breaches. We have a process for our Senior Vice President of Finance and Administration and/or our Chief Financial Officer, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program and on an as needed basis.

companyName: ImageneBio, Inc.

ticker: IMA


text: We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements. We collaborate with service providers to help assess the sufficiency of their cybersecurity measures and require service providers to notify us promptly of cyber incidents that may affect our systems or data.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: The Trust does not have computer systems or networks. Pursuant to the terms of the Trust Agreement, the Trust's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on the Trust, USCI and CPER. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and the Trust.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: The Company has been and continues to be the target of cyber-attacks and network disruptions. To date, the risks posed by such cybersecurity threats have not materially affected the Company and its business strategy, results of operations and financial condition, and as of the date of this report, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so, but there can be no assurance that the Company will not be materially affected by such risks in the future. For further information, see Item 1A. "Risk Factors — The Company is increasingly dependent on sophisticated software applications and computing infrastructure. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations."

companyName: Merck & Co., Inc.

ticker: MRK


text: Cybersecurity threats are endemic to the modern business environment, and attempts to penetrate our network security are frequent and on-going. However, to date, no cybersecurity threats (including incidents) have resulted in a material impact on our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident, that we will not experience a cybersecurity incident in the future, or that a past cybersecurity incident will not result in a future material impact. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: The data centers support robust monitoring and logging capabilities, allowing us to track and analyze security-related events in real-time. This includes audit logging, activity tracking, and integration with security information and event management (SIEM) systems.

companyName: AIRWA INC.

ticker: YYAI


text: Collaborating closely with business stakeholders, our CISO shapes a comprehensive cybersecurity strategy that serves as the cornerstone of our information security programs, supporting effective cybersecurity risk management. Leading the cybersecurity risk assessment process, our CISO utilizes a robust incident response plan to handle high-severity cybersecurity incidents promptly. In cases of potentially material cyberattack incidents, or a series of smaller similar incidents, our CISO promptly engages a cross-functional incident response team to determine the materiality of the incident and whether public disclosure is necessary.

companyName: RALPH LAUREN CORP

ticker: RL


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, employee training, access controls, cyber insurance, and systems monitoring.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our cybersecurity risk management process is designed to identify and manage internal and external cybersecurity threats and vulnerabilities to and within our business and operations. Our cybersecurity program is integrated into our overall risk management systems, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. Our cybersecurity program includes systems and processes such as, but not limited to, maintenance and monitoring of information security policies, implementation and maintenance of infrastructure security systems, programs and policies designed to promote employee awareness of cyber policies and practices (including implementing an annual process for employees to complete security awareness training in addition to new employee cybersecurity awareness training), information systems configuration management, use of third-party risk management systems, process to promote identity and information asset protection and cybersecurity threat operations with continuous monitoring. This program also includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Evolus, Inc.

ticker: EOLS


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations. As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager also uses the National Institute of Standards of Technology (NIST) Cybersecurity Framework to assess its cybersecurity controls.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Our CTO, who reports directly to our Chief Executive Officer, is responsible for assessing and managing cybersecurity risks. Our CTO has gained substantial information technology and cybersecurity knowledge from over 25 years of work experience at the Company and elsewhere. Our CTO receives reports on cybersecurity threats from our dedicated information technology team on an ongoing basis and, in conjunction with management, regularly review risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CTO also works closely with our legal and compliance departments to oversee compliance with legal, regulatory and contractual security requirements.

companyName: DocGo Inc.

ticker: DCGO


text: Through this dynamic risk assessment and governance process, the Risk Management Committee and Board consistently evaluate the risk environment and adjust the Company's risk profile, including cybersecurity and data privacy risks, and focus as needed to respond to industry and macroeconomic changes and to protect the Company.

companyName: Anywhere Real Estate Group LLC


text: Other Committees. In addition to the ITCC and Risk Committees, we have established a Technology Committee, a Senior Management Committee, and a Business Continuity and Disaster Recovery (BC/DR) Committee. Each oversees aspects of our ISSP and coordinates with the ITCC to implement various cybersecurity procedures.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our Director of Cybersecurity has served in various roles in technology leadership and cybersecurity for over 20 years. Our Chief Information Officer has served in various roles in technology and business leadership for more than 40 years. Our Chief Executive Officer, Chief Financial Officer and Chief Information Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies including risks arising from cybersecurity threats.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk counsel, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Our Chief Information Security Officer (CISO) is primarily responsible for assessing, monitoring and managing our cybersecurity risks. With over 30 years of experience in the field of information technology and cybersecurity, the CISO brings a wealth of expertise to his role. His background includes experience as a cybersecurity professional and system security engineer at the Pentagon, the State Department, and several other Federal agencies, as well as serving as Chief Information Officer (CIO) for international federal contractors and a Maryland state agency, resulting in extensive knowledge and experience in developing and executing cybersecurity strategies. The CISO holds a Doctorate degree in Information Assurance and a Master's degree in Computer Systems Management from the University of Maryland, and holds a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certification, awarded and maintained since 2010 and 2015, respectively.

companyName: V2X, Inc.

ticker: VVX


text: With over 30 years of industry cybersecurity experience, the Company's Chief Information Security Officer ("CISO") is the member of the Company's management team with primary responsibility for the development, operation, and maintenance of the Company's information security program. The CISO supervises the Company's cybersecurity team, facilitates the incident response plan and acts as the liaison to the Company's executive management team, including relaying strategies, resource requests and incident updates. The Company's security event monitoring and detection capabilities are performed by our Cybersecurity team and third parties through the use of processes and tooling. Cybersecurity incidents are responded to by a multi-disciplinary Incident Response team and if appropriate, escalated to our Cybersecurity Disclosure Subcommittee, Executive Management, and the Board. The level of escalation will vary depending on the severity and scope of the cyber incident. In the event of a severe cyber incident, the CISO will escalate to the relevant subcommittee to determine the course of action. All relevant roles are trained on their responsibilities regularly. The Board, along with the Risk and Audit Committees of the Board, oversees our information security program. In 2024, our Board and Risk and Audit Committees received periodic updates throughout the year on cybersecurity matters, and these updates are part of their standing agendas. These updates include reports regarding items such as cybersecurity strategies, program effectiveness, key risks and performance metrics related to the Company's information security program and the Company's mitigating controls.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Our cybersecurity program is intended to assess, identify, and manage material risks from cybersecurity threats, including those associated with our use of third-party service providers. We integrate cybersecurity into our top-level enterprise risk management ("ERM") processes and our site-level operational risk management ("ORM") processes, including management of operational technology ("OT") cybersecurity risks. This involves, in part, direct engagement by, and consultation with, our Senior Director of Cybersecurity and IT Infrastructure ("Senior Director") during ERM and ORM risk assessments, and collaboration between the Senior Director and relevant Operations employees regarding OT cybersecurity.

companyName: Coeur Mining, Inc.

ticker: CDE


text: The NGC routinely engages with the Chief Financial Officer ("CFO"), the CISO and Senior Vice President on a range of cybersecurity-related topics, including threats to the environment and vulnerability assessments, policies and practices, technology trends and regulatory developments. The NGC conducts regular committee meetings prior to each regular Board of Directors meeting and convenes additional sessions as necessary to address a specific cybersecurity threat.

companyName: PERRIGO Co plc

ticker: PRGO


text: We recognize the critical importance of maintaining the trust and confidence of universities, medical institutions, clinical investigators, CROs, strategic collaborators, business partners, employees, and others, and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are informed, in part, by recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: As the Fund evaluates the materiality level of a data incident it will consider a variety of factors including the operational impact, the type of data impacted, how the data has been impacted, the business continuity and recovery procedurs affected, the impact of the incident on the Fund's finances and any length of service interruption. Additional factors may also be considered given the nature of the event.

companyName: Wellings Real Estate Income Fund


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee (the "IT Operating Committee") made up of the Director of Information Technology, the CISO, and our department heads, which is responsible for the establishment and review of our IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of our executives, which provides guidance and oversight to support and achieve our IT objectives, including cybersecurity objectives. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews our plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with our internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within our enterprise risk management strategy.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Our VP IT, the Manager of the Infrastructure Team, and our General Counsel make up the Information Security Committee, which has the initial responsibility for the assessment of and response to cybersecurity incidents consistent with our formal incident-response plan. Pursuant to the incident-response plan, more serious incidents are escalated to other senior members of management, including the Chief Executive Officer, Chief Financial Officer, and Chief Accounting Officer, as well as to the Audit Committee and our external auditors, as appropriate.

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: Like all businesses, the Company faces cybersecurity threats, as the Company is reliant upon information systems and the Internet to conduct its business activities. For example, in connection with payment card sales and other transactions, including bank cards, debit cards, credit cards and other merchant cards, the Company processes and transmits confidential banking and payment card information. Additionally, as part of its normal business activities, the Company collects and stores sensitive personal information related to the Company's employees, customers, suppliers and other parties. Businesses, including those in our industry, and third parties on which we rely are frequently confronted with a broad range of cybersecurity threats, from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: The Audit Committee oversees our overall enterprise risk assessment and risk management policies including risks related to cybersecurity. The Board and Audit Committee set the tone at the top by providing oversight and establishing expectations for the overall effectiveness and efficiency of the information security program. Each quarter, our CISO provides a quarterly update to the Audit Committee about our cybersecurity program, including detection, mitigation, and remediation of significant incidents, if any, that occurred during the quarter. Additionally, on an annual basis, the CISO delivers reports to the Board and Audit Committee with an annual cybersecurity risk assessment that includes information concerning the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any, including material security risks and information security vulnerabilities. The Audit Committee provides a quarterly summary of all important issues to the full Board.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees (Information Systems and Data).

companyName: Freshworks Inc.

ticker: FRSH


text: Related to Cybersecurity Risks Our board of directors, as a whole and through its committees, holds overall oversight responsibility for our risk management processes, including in relation to risks from cybersecurity threats. Our board of directors exercises its oversight function through the audit committee, which oversees the management of risk exposure across various areas, including cybersecurity risks, in accordance with its charter. The audit committee receives quarterly reports from our Management on the status of our cybersecurity program. The Chair of the audit committee provides a quarterly report to the board of directors, which includes any key updates on cybersecurity matters, as applicable.

companyName: MILESTONE SCIENTIFIC INC.

ticker: MLSS


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity program, current activities and planned projects. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Additionally, in Item 1A Risk Factors under the heading of "Operational Risk Factors," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: LA-Z-BOY INC

ticker: LZB


text: Third-party vendors are vetted through our service delivery program to ensure they have an established cybersecurity program. We have also engaged our managed security provider to manage a supply chain defense subscription that will help obtain clear visibility into cybersecurity risks across third party vendors by proactively identifying, prioritizing, and driving remediation for cyber risks posed by critical business partners. Our managed security provider's risk operations center will escalate certain alerts regarding third-party vendors directly to the appropriate business partners thus providing direct collaboration with third parties, saving time and improving risk reduction while safeguarding our relationships with such third parties.

companyName: W. P. Carey Inc.

ticker: WPC


text: As a global company, we are regularly subject to cyberattacks and other cybersecurity incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by our Chief Information Security Officer ("CISO") and our Chief Customer and Technology Officer ("CCTO"), to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations. We also are a member of an industry cybersecurity intelligence and risk sharing organization to stay abreast of changes in the cybersecurity environment.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Cybersecurity Framework"). While we generally consult the NIST Cybersecurity Framework when designing and assessing our cybersecurity risk management program, we have not implemented and do not plan to implement all categories and subcategories included in the framework. We use the framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business based on our current understanding of the cybersecurity threat environment.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: NEE conducts an annual internal cybersecurity drill with the participation from time to time of local, state and federal agencies to test its capability of dealing with a simulated cyber-attack. NEE also participates in industry forums and trade groups, as well as, in NERC activities to learn and apply these learnings to its cybersecurity policies and procedures.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Our Director of Information Technology Infrastructure leads a dedicated management committee responsible for overseeing cybersecurity matters. The Information Security committee contributes decades of experience in technology, cybersecurity, architecture, and incident response in both military and private sector with certifications including Certified Information Systems Security Professional ("CISSP"), Certified Ethical Hacker ("CEH"), CompTIA Secure Infrastructure Specialist ("CSIS"), and degrees in cybersecurity, data science, and computer science. Collectively, this team has served in various large, publicly traded companies, implementing and managing robust IT and cybersecurity programs, developing tools, and safeguarding internal networks, business applications, customer-facing applications, and payment systems. This committee consists of members with diverse expertise, including information technology, legal, risk management and finance, who collaborate to provide strategic guidance, evaluate potential risks and ensure the adequacy of our cybersecurity measures. The committee regularly provides updates to senior leadership and the Audit Committee, as well as the full Board, which includes information regarding our cybersecurity program initiatives, program performance, and the reporting provided by third party service providers.

companyName: AZZ INC

ticker: AZZ


text: However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: AGM ' s CSO holds an undergraduate degree in Management Information Systems and Business Administration, which he received magna cum laude. He has over 25 years of cyber-related experience, having served in various roles in technology and cybersecurity, including as Head of IT Risk Management, Executive Director of IT & Risk Compliance, and Global IT Risk Evaluation Lead at large financial institutions and consulting firms. He was also previously AGM ' s CISO for nearly eight years. AGM ' s CISO holds a master ' s degree in Business Information Systems and has served in various roles in information technology and information security for over 25 years across a number of large financial institutions, including as Director, Cybersecurity and Risk.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Cybersecurity-related risk events are reported to Ocwen's Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Ocwen, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Cybercriminals, hackers, and threat-actors are becoming more sophisticated and effective every day. To mitigate threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data that our customers and other stakeholders entrust to us a top priority. We are committed to safeguarding the confidentiality, integrity, and availability of all physical and electronic information assets to ensure that regulatory, operational, and contractual requirements are fulfilled. Our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we have technology and processes in place to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. We have not previously experienced a cybersecurity event that was determined to be material, and our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: VirnetX Holding Corp

ticker: VHC


text: Effect of Risk To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring to inform our risk identification and assessment, as well as undertaking the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, device encryption, multi-factor authentication, advanced threat protection for emails, anti-virus and anti-malware functionality and access controls, which are evaluated and improved from time to time; • conduct regular phishing email simulations and cybersecurity training for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; and • employ multiple backup systems for our data stored on our servers or other information systems.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: The CSLT supervises our efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through a variety of means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and reports from cybersecurity systems deployed in our IT environment.

companyName: Avery Dennison Corp

ticker: AVY


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The Company has a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Incident Response Planning: We maintain a cybersecurity incident response plan that defines procedures for addressing security events. This plan is updated and tested regularly (including through tabletop drills and simulated breach exercises) so that our teams remain practiced in incident handling. In the event of an incident, our aim is to respond swiftly to contain the issue, notify appropriate stakeholders, investigate the root cause, and recover normal operations as soon as practicable.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: The Audit Committee of the Board of Directors oversees cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of our cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, a review of the vendor's written security program, a review of security assessments and reports, audits, vulnerability scans related to the vendor, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1, Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact and cyber security awareness. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by department managers and include the Information Security Officer and Chief Technology Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: The Company's internal Incident Response Policy sets forth specific protocols for cyber or data incident detection, response and recovery. This process includes the assembly of a response team consisting of internal and, as required, external technical and legal experts upon the event of a cyberattack or incident. The Company reviews and updates this process regularly, including by engaging in tabletop exercises to simulate cybersecurity and data breach incidents. The Company maintains global cybersecurity insurance coverage that is reviewed annually for adequacy against operations and information systems.

companyName: IDEX CORP /DE/

ticker: IEX


text: If a cybersecurity incident were to occur, it could affect our operations, results of operations, or financial condition as described in our Risk Factors titled "Information technology system failures or interruptions may materially impact our operations and/or adversely affect our financial results" and "We could be materially adversely affected by a cybersecurity breach or failure of information security controls."

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Incident Response and Recovery Plans: The Company has established and maintains comprehensive incident response and recovery plans, which detail the steps to be taken from the initial internal reporting of a potential cybersecurity incident.

companyName: WillScot Holdings Corp

ticker: WSC


text: Incidents and Responses As of the date of this Annual Report on Form 10-K, we have no t identified any risks from cybersecurity threats that have materially impacted our Company, our business operations, and our financial condition. Recognizing the potential impact of significant disruptions, we remain committed to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. For additional detail about the cybersecurity risks facing our Company, and whether they are reasonably likely to affect our Company, please see the discussion in Item 1A, "Risk Factors."

companyName: Urgent.ly Inc.

ticker: ULY


text: As a company that provides enabling platform technologies to advance the discovery, development and commercialization of next-generation cell therapeutics for customers, we are committed to protecting the confidentiality, integrity and availability of our and our customers' information assets. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats and cybersecurity incidents, as such terms are defined in Item 106(a) of Regulation S-K. Our exposure to applicable cybersecurity risks is described more fully under the Risk Factors in Item 1A in this annual report on Form 10-K. As described further below, we maintain a formal and comprehensive information security management framework informed by the National Institute of Standards and Technology ("NIST") cybersecurity framework and have implemented several dozen policies governing our information security program, which we revise and update annually. Our Board, including the Audit Committee of our Board, and our management team are actively involved in the oversight of our enterprise risk management program, of which cybersecurity represents an important component.

companyName: MAXCYTE, INC.

ticker: MXCT


text: These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: The Premier Board of Directors has assigned to the Board Risk Committee ("BRC"), along with the ERMC, oversight of risk management, including risks associated with information security and cybersecurity. The BRC is comprised of independent directors of Premier with participation from Premier's executive leadership and additional members of management. The ERMC is chaired by the Chief Risk Officer and, in addition to general oversight of risk management, is responsible for documenting all risks for the organization and reporting to the BRC issues of a critical nature. The ERMC meets monthly and is a cross-functional group comprised of all members of executive leadership and additional members of management from different areas of the Company. The ISOC) is responsible for managing and mitigating information security and cybersecurity risks where appropriate and escalates issues to the ERMC. The ISOC is chaired by the CISO and includes select members of executive leadership and representatives from the Risk Management Department and Information Technology Department. The ISOC meets at least monthly. Routine reporting of the status of cybersecurity risks and mitigation activities progress from the ISOC to ERMC and finally to BRC.

companyName: PREMIER FINANCIAL CORP


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to follow our industry's best practices and provides a framework for identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including threats and incidents associated with the use of third-party vendors and service providers, and facilitating coordination across different departments of the Company. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider; assessing the severity and risk of a cybersecurity threat or incident; implementing cybersecurity countermeasures and mitigation strategies and informing management, our audit and risk committee, and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape.

companyName: Remitly Global, Inc.

ticker: RELY


text: Our CISO Team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO Team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Rubrik, Inc.

ticker: RBRK


text: We have an Information Security Management Steering Committee (the "ISMS Committee"), comprised of our CISO, as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, CIRT, and ISMS Committee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO has over 28 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: We use a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Third Party Risk Management We also monitor and manage cybersecurity risks associated with our third-party service providers, including our managed security service provider, suppliers, customers and vendors, through, among other things, the processes set forth in our policies and procedures, due diligence processes, regular oversight, monitoring and auditing of our relationships by internal staff, supplier codes of conduct and escalation practices for reporting issues. We require our third-party providers to meet appropriate security requirements and controls prior to providing access to our internal systems, and investigate and report any security incidents, as appropriate.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Our Chief Product and Technology Officer reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks. The Head of Internal Audit and the Chief Operating Officer provide an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. We have also established a Cyber Incident Disclosure Committee, which is responsible for assessing the impact and materiality on the Company and its stakeholders of any significant cybersecurity incidents and any disclosure obligations arising from any such incidents, as applicable. The findings of any incidents by the Cyber Incident Disclosure Committee are reported to the Audit Committee by the Chief Product and Technology Officer.

companyName: ThredUp Inc.

ticker: TDUP


text: Despite these efforts, the rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents. In addition to the foregoing, management and the board are evaluating, and intend to implement, further cybersecurity related measures, including without limitation developing a more robust internal policy framework, incident response plan, crisis management planning, and third-party vendor assessments and contractual obligations for third parties that the Company engages with. The Company intends to progress these efforts throughout 2024.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.

companyName: Open Lending Corp

ticker: LPRO


text: The Company's Chief Information Security Officer ("CISO") is the member of the Company's management team with primary responsibility for the development, operation and maintenance of the Company's information security program. The CISO holds a master of science degree in information assurance and has approximately 24 years of cybersecurity experience with Fortune 500 financial, defense, consulting and retail companies. The Company's Audit Committee oversees the Company's information security program at the Board level. The Audit Committee, which is composed entirely of independent members of the Board, receives reports directly from the CISO at least twice per year regarding the Company's cybersecurity program, including reports regarding items such as cybersecurity policies and practices, cybersecurity program resources, third-party assessments of the Company's information security program, key risks related to the Company's information security program and the Company's mitigating controls. As described above, the Company maintains an information security incident response plan that includes processes and procedures for evaluating and escalating cybersecurity incidents to, as determined to be appropriate, the Company's executive management team and members of the Board. The initial impact level of each cybersecurity event is evaluated by a designated team of information security specialists using risk criteria that have been defined and approved by the Company's executive management team and reviewed with the Company's Audit Committee. If escalated, the incident is evaluated by a cross-functional core and extended team, as applicable, of Company managers that includes the Company's CISO and the Company's designated internal legal counsel, as well as identified associates from across the Company's business and functions, as applicable. Cybersecurity incidents are assigned incident impact levels based on the core team's determination of potential impact to the Company. The core team employs defined risk criteria to classify incidents and escalate incidents accordingly. Based on the severity classification assigned by the core team, incidents may be escalated to representatives of the Company's executive management team (which includes the Company's Disclosure Committee), the Chairs of the Board and the Audit Committee, other members of the Audit Committee and/or the full Board. The incident response plan, which also incorporates processes to engage identified third-party cybersecurity consultants, advisors and response services, provides for continuous re-evaluation of identified cybersecurity incidents by the appropriate levels of management to ensure that the Company is able to satisfy its disclosure obligations under relevant rules and regulations.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Based on the information available as of the date of this Annual Report on Form 10-K, cybersecurity risks, including as a result of any previous cybersecurity incident, have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we have seen an increase in cyberattack volume, frequency, and sophistication in the digital environment and future incidents could have a material impact on our business, operations, or financial condition.

companyName: DEERE JOHN CAPITAL CORP


text: We have a unified and centrally-coordinated team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Gold Flora Corporation in close coordination with senior leadership and other teams across the Company. Reporting to our Director of IT are a number of experienced system administrators and managed service providers "MSP" responsible for various parts of our business, each of whom is supported by a team of trained cybersecurity professionals. In addition to our in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Gold Flora Corp.

ticker: GRAM


text: We have established controls and procedures designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner. We intend to continue to review and enhance our incident response and recovery plan for the Company. Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. Our incident response and recovery plans and policies will address — and guide our employees, management and the Board on our response to a cybersecurity incident.

companyName: VerifyMe, Inc.

ticker: VRME


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability, such as the ongoing monitoring of our systems, including with the assistance of third party vendors, conducting routine exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes, and engaging with proxy advisors and external cybersecurity rating agencies that assess our cyber risk to improve our internal evaluations and vulnerability management processes. In addition, to help promote privacy and security awareness throughout the company, all employees with a valid Baxter email address receive annual training and access to virtual events and updated materials. Further, our Third-Party Risk Management Program includes assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats to and security incidents relating to information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Akero Therapeutics, Inc.


text: We use third party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Our Cybersecurity Team Our management is responsible for assessing, managing and mitigating all risks relative to our business, including material risks from cybersecurity threats. Within our management team, assessment, management, and mitigation of cybersecurity threats is primarily overseen by our technology group, which has extensive experience in cybersecurity, technology, and digital grid operations. Our technology group is led by Joel Austin, our senior vice president and chief digital officer, and Malia Hodges, our senior vice president and chief information officer. Mr. Austin has over 35 years of technology operations, utility industry, and leadership experience, including more than 16 years of cybersecurity oversight experience. Ms. Hodges has 26 years of technology operations, utility industry, and leadership experience, including seven years as our chief information officer, with responsibility in that role for management of Oncor's technology function, including cybersecurity. Both Mr. Austin and Ms. Hodges are long-time members of the Edison Electric Institute security and technology policy committee, which focuses on working with federal agencies on cybersecurity risks relevant to the electric industry. Mr. Austin has testified on cybersecurity issues facing the State of Texas and the electric utility industry in front of multiple Texas legislative sub-committees and been asked to discuss cybersecurity risks with members of the U.S. Congress. Mr. Austin and Ms. Hodges also work closely and regularly with PUCT staff and PUCT commissioners on cybersecurity risks and mitigations. We also have a designated chief information security officer who has over 43 years of experience in cybersecurity, a master's degree in cybersecurity and a doctorate degree in cybersecurity/information assurance. Within our technology group, we maintain a dedicated cybersecurity group and 24/7/365 team that responds to and protects against cybersecurity risks. Our collective cybersecurity staff consists of a group of employees and contractors located inside and outside the state of Texas with a wide range of specialized skills and experience, including through service in the U.S. military and federal agencies, cybersecurity-related certifications, membership and advisory and board positions with industry groups and non-profit organizations focused on cybersecurity, and training in the cyber defense tools and methods we deploy, as well as various higher education degrees related to cybersecurity.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: We recognize cybersecurity as a critical aspect of our overall risk management program and are committed to maintaining a cybersecurity program to protect our information assets, systems, and operations. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risks areas. We continuously evaluate and enhance our cybersecurity program based on lessons learned, industry best practices and feedback from internal and external stakeholders.

companyName: DIXIE GROUP INC

ticker: DXYN


text: IT Risk Management maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains an Incident Response Plan (IRP) that covers response and remediation processes for managing cybersecurity incidents. The Incident Response Team (IRT) members include senior management and other relevant personnel, with defined roles and responsibilities. IRP metrics related to monitoring and detection are presented to the ISSC and reported to the board. The IRT is notified of all incidents, and incidents are elevated to the board when warranted.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: Our advisor conducts annual cybersecurity training to ensure all employees are aware of cybersecurity risks and conducts monthly phishing e-mail simulations. Annually, our advisor engages a third party to conduct penetration testing to assess our cybersecurity measures and to review our information security control environment and operating effectiveness. Our advisor also uses a third-party platform to monitor our information security continually. The results of such assessments and reviews are reported to the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. For any software platforms that are hosted by third parties, our advisor requires the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches," which disclosures are incorporated by reference herein.

companyName: NexImmune, Inc.

ticker: NEXI


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer and research data or sales information.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: When appropriate, we use external subject matter specialists to provide incident response services and to conduct independent assessments of internal response readiness. We conduct tabletop scenario planning, covering a range of potential cybersecurity threats, as part of our internal response readiness assessment. We also maintain a supply chain cybersecurity compliance and risk mitigation program to assess material cybersecurity risk from third parties.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CISO and Senior Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CISO and Senior Director of Information Security have been in their respective roles at Arcosa for over 6 years. The CISO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Senior Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.

companyName: Arcosa, Inc.

ticker: ACA