text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information, and have adopted policies, management oversight, accountability structures and technology processes designed to safeguard this information. All our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the Silvercrest data and systems to which they have access. These trainings also remind employees how to report any potential privacy or data security issues.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: Our Chief Executive Officer and President, Dana Green, is responsible for the oversight of risks from cybersecurity threats. The Board will receive information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management, which includes that of the Company. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.

companyName: GlobalTech Corp

ticker: GLTK

secItem: Item 1C


text: Our CIO, as the leader of our IT organization, is responsible for executing enterprise, product and manufacturing cybersecurity programs with a focus on security architecture, vulnerability testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training and governance. Our CIO and IT management team meet regularly to develop and oversee strategies to protect our data, systems and technology across the organization. These strategies include reviewing security performance metrics, identifying security risks and assessing the status of approved security enhancements. Our CIO receives regular updates from our IT management team on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation. The IT organization also makes recommendations on security policies and procedures, security service requirements and risk mitigation strategies.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.

companyName: Immunocore Holdings plc

ticker: IMCR


text: KKR also has a cybersecurity incident response plan that is specific to our insurance business. The plan sets forth the roles and responsibilities of the Global Atlantic incident response team, which is comprised of Global Atlantic employees representing key business functions at our insurance business and is overseen by the Global Atlantic CISO. Global Atlantic utilizes several mechanisms to monitor and manage the cybersecurity risks of our insurance business, including to prevent, and prepare to respond to, an incident. This includes maintaining relationships with external incident response organizations, performing periodic cybersecurity risk assessments, overseeing and monitoring risks from cybersecurity threats associated with third-party service providers, and ensuring that Global Atlantic employees complete security awareness training relating to cybersecurity best practices. Global Atlantic also has a cybersecurity notification framework in place to determine when appropriate notifications and escalations are required to be provided to senior members of Global Atlantic's management, members of Global Atlantic's board of directors and members of KKR's Risk and Operations Committee, certain members of which would, as appropriate, report such information to our Board of Directors or its Audit Committee or Risk Committee.

companyName: KKR & Co. Inc.

ticker: KKR


text: The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: Our cybersecurity risk management processes are integrated into our enterprise risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered to be an important component of our enterprise risk management approach. Our cybersecurity strategies are based on standard cybersecurity frameworks, including the National Institute of Standards and Technology and the International Organization for Standardization.

companyName: Antero Midstream Corp

ticker: AM


text: We also maintain an enterprise-wide incident response plan designed to secure the enterprise, mitigate the impact of a cybersecurity incident, recover and restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. Management, including our Executive Director, Corporate Information systems, collaborates with our information technology team and technical partners to review at least annually our enterprise-wide incident response plan. Periodically, we engage assessors, consultants, auditors and other third parties, including by conducting exercises with an external partner to stress test our data security systems and practice company-wide response tactics. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, and third-party risks are included within our enterprise risk management program. In the event of a suspected or actual cybersecurity event, we have partnered with a globally recognized digital forensics investigation firm and outside counsel to provide services and support on a real-time basis to analyze any breach and secure both our data and information systems.

companyName: Vericel Corp

ticker: VCEL


text: For a description of the risks from cybersecurity threats that may materially affect our company and how they may do so, see our risk factors listed in Part 1, Item 1A of this Annual Report on Form 10-K, including the section titled "Risks Related to Cybersecurity, Information Technology and Intellectual Property."

companyName: Vital Farms, Inc.

ticker: VITL


text: Cybersecurity threats have not materially affected our company, including its business strategy, results of operations or financial condition. Our company is not aware of any material security breach to date. Accordingly, our company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that our third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be effective in protecting our systems and information.

companyName: Mobiquity Technologies, Inc.

ticker: MOBQ


text: Cybersecurity risk management is led by our SVP of Information Technology, who reports to our Chief Operating Officer, and generally is responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The SVP of Information Technology manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.

companyName: SKECHERS USA INC


text: Information Security Program Vendor Management. The Company maintains a formally documented Vendor Management Program that includes an information security review of all new and existing third-party vendor relationships. The Vendor Management team ensures initial and ongoing due diligence is performed on all party relationships according to policy. Quarterly Vendor Management program updates are provided and the Policy is reviewed and approved annually by the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff. We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees. As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses. Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Envestnet's senior management assesses and manages material risks from cybersecurity threats through its Information Security Management Committee. The Information Security Management Committee provides direction, management, support and sponsorship associated with information security. Chaired by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security Management Committee consists of Envestnet's Executive and Senior management from Operations, Legal, Compliance, Systems, Business, Human Resources and Finance.

companyName: ENVESTNET, INC.


text: The Board has primary oversight responsibility for our cyber and information security risk as a key part of its oversight of Valley's enterprise-wide risk management (ERM) framework, and we employ personnel dedicated to assisting the Board in fulfilling this oversight responsibility. As a general matter, Valley seeks to address cyber and information security risks through a cross-functional approach, as described below, that is focused on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our information security team reviews ERM-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year at its Executive Risk Committee.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks, including cybersecurity. The Board of Directors is responsible for regularly reviewing with management our cybersecurity practices and policies. As part of its oversight role, the Board of Directors receives regular reporting about our strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through quarterly updates from the Chief Information Officer ("CIO") who is also our Chief Information Security Officer ("CISO").

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our Chief Technology Officer reports to our Chief Executive Officer and leads the Company's overall cybersecurity function, including the assessment and management of cybersecurity risks. The Chief Technology Officer has over 25 years of experience in managing and leading information technology or cybersecurity teams and participates in various cybersecurity organizations. The Chief Technology Officer collaborates with operation vice presidents and department vice presidents to identify and analyze cybersecurity risks to us; considers industry trends; implements controls, as appropriate and feasible, to mitigate these risks; and enables business leaders to make risk-based business decisions that implicate cybersecurity considerations. The Chief Technology Officer meets with senior leadership to review and discuss our cybersecurity program, including emerging cyber risks, threats, and industry trends. The Chief Technology Officer also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with external security personnel and internal business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public, or private sources to inform our cybersecurity technologies and processes.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Our cybersecurity program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, software, and services; (ii) a cybersecurity team principally responsible for managing our (1) information security risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; (iii) risk assessments and security tests, conducted internally; (iv) new-hire and annual cybersecurity awareness training of our employees; (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and (vi) third-party risk assessment procedures to review material third-party vendors and applications for information security. Our cybersecurity team is responsible for assessing our cybersecurity risk management program and we also engage a third party for such assessment.

companyName: Acutus Medical, Inc.


text: The CISO is notified of cybersecurity events as needed based on the Company's processes for addressing cybersecurity incidents and threats. The SOC, with the assistance of outside third-parties as needed, analyzes, evaluates and remediates cybersecurity incidents and provides investigative information to the CISO. Depending on the significance of any specific cybersecurity incident or threat, and/or relation to prior incidents, the CISO will escalate relevant information, as appropriate, and the Company's legal and accounting groups, with assistance from other company departments and third parties, will assist in assessing potential SEC disclosure obligations. The CISO coordinates disclosure to other agencies, when necessary, including requirements under the Transportation Security Administration directives.

companyName: CSX CORP

ticker: CSX


text: The Enterprise Risk Committee is kept informed of these risks through reporting by the Chief Information Security Officer ("CISO") and is also charged with reviewing cybersecurity policies, results of an annual information security risk assessment, NYS DFS Compliance Status, and other information security risk assessments or analysis of significant events that may occur throughout the year. The Enterprise Risk Committee additionally reviews the results of vulnerability and penetration testing, tabletop exercises, and other examinations performed, whether internal or external, with a focus on cybersecurity. The Enterprise Risk Committee is kept informed of cybersecurity risks through the Company's first and second lines of defense, including the Company's CISO, which provide the following to the Enterprise Risk Committee on a quarterly basis, or more frequently as needed: an analysis comparing actual results against the Company's Cyber and Technology Risk Appetite Statement, an evaluation on current cybersecurity risks facing the company, and identification of any new or emerging risks associated with cybersecurity. The Audit Committee of the Board of Directors is also informed of any cybersecurity risk that is identified in annual information security specific internal audits or material cybersecurity risks that may have an impact on the financial statements and related disclosures of the Company.

companyName: EVANS BANCORP INC


text: The audit committee of the Board oversees the Company's risk management program, including the management of risks arising from cybersecurity threats. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. When necessary, the Board receives prompt and timely information regarding any material cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the audit committee of the Board discusses the Company's approach to cybersecurity risk management with the Company's Head of Information Technology.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: TransUnion

ticker: TRU


text: Our Chief Financial Officer has primary responsibility for assessing and managing material risks from cybersecurity threats. The Chief Financial Officer meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The Chief Financial Officer and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Risk Management Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative ("CSI") committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization. The Information Security Officer reports directly to the Chief Operating Officer and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have been expanding our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Zoetis Inc.

ticker: ZTS


text: The Sponsor prohibits Supervised Persons from installing software on company owned equipment without first obtaining approval from the CISO or other designated person(s);

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Annually, we conduct a cybersecurity risk assessment with quarterly updates to the Audit Committee of the Board that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., cybersecurity alerts and advisories from the U.S. Cybersecurity & Infrastructure Security Agency, relevant technology vendors, related companies, industry trends, and evaluations by third parties and consultants). The results of these assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee, and members of management.

companyName: PGT Innovations, Inc.


text: The Manager engages an independent cybersecurity vendor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require third-party service providers with access to personally identifiable information to adhere to our security standards and protocols.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: Through ongoing engagement with these internal teams and certain third-party service providers, our CIO and our Managing Director of Information Security monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report on cybersecurity incidents. The Company has a notification process in our incident response plan that contains requirements for timely notification to senior management by the CIO and to the Board of Directors by the CEO for incidents that reach established thresholds as well as procedures for external reporting.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Astrana, like the rest of the healthcare industry, continues to innovate and rely on digital technology, further increasing the importance of cybersecurity to the business. The world is seeing an increase in cyberattacks by nation-states, hacktivists, organized cybercriminal groups, and insider threat actors, all of which may, among other avenues of attack, be using artificial intelligence ("AI") and distributed hosted environments across different geographies to attack their victims. These threat actors may be individuals or part of a cyber organized crime group that leverages large-scale Cybercrime-as-a-Service ("CaaS") subscriptions to quickly scale the impact of attacks and avoid disruption to their operations.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Monitoring Cybersecurity Incidents The CISO is informed about the developments in cybersecurity, including potential threats and risk management techniques. This ongoing knowledge acquisition is crucial for the prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, the CISO is equipped with a cyber incident response plan ("CIRP") supported by a cross-functional cyber incident response team ("CIRT"). The CIRT oversees and responds to cybersecurity incidents. Its core objectives encompasses detection and response, conducting incident analysis and investigation, implementing containment and eradication measures, and facilitating recovery processes. It also entails coordinating and communicating with the Company's management, regulators, affected parties, and external security experts. The CIRT determines the materiality of the incident, maintains documentation and reporting practices, and fosters a culture of improvement.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Material Risks & Integrated Overall Risk Management have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: Our Compliance Committee members have decades of business and leadership experience managing risk, including cybersecurity risks, that collectively enables them to effectively oversee comprehensive cybersecurity risks. Our CIO has served in various roles in information technology for more than 30 years, including serving as a chief information officer for a technology company, and has a degree in information management systems. Information Security Program leaders and Team Members who support our Information Security Program have relevant educational and technical certifications, such as Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP), and applicable industry experience, including cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance. For further details about our CIO's background, see the "Information About Our Executive Officers" section of Item 1 of this annual report on Form 10-K.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: We have recently implemented additional security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. All employees have recently begun receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: The Head of IT reports on the status of our cybersecurity risk management program to management and our Audit Committee on a periodic basis, which may include a discussion of the results of our annual third party cybersecurity risk assessments and critical updates to our mitigation and remediation efforts.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: Our Cybersecurity and Privacy Committee, at the direction and on behalf of the Board of Directors, addresses our cybersecurity risk management as part of its general oversight function. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Information Officer and Senior Vice President, who has 35 years of Application/Systems experience and our Vice President of Cybersecurity, who has 20 years of Cyber/Network experience.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Luxfer has a wide breadth of controls in place to protect against cyber-attacks including firewalls, threat monitoring systems, protected cloud architecture, and more frequent security patching. We have phased out vulnerable operating systems and updated legacy servers with advanced security. Applications that run and manage our core operating data are fully backed up.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: See "Risk Factors - Risks Related to Our Business and Operations" for additional information about the risks to our business associated with cybersecurity or a breach or compromise to our information security systems.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The IT/Cybersecurity Committee of the board of directors regularly reviews our cybersecurity program with management and reports to the Board of Directors. The IT/Cybersecurity Committee meets at least quarterly (or more frequently as may be required), and receives updates from the CISO on topics with respect to the cybersecurity program. The IT/Cybersecurity Committee reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The management IT/Cybersecurity and Risk Committees each provide reports of their activities to the full board of directors at each board meeting in the event all board members are not present at the relevant board committee meetings.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Our CISO has over two decades of experience in various roles involving information security: developing and implementing cybersecurity programs to protect the confidentiality, integrity, and availability of information systems and data. Our CISO has earned relevant degrees and holds several information security certifications, including the Certified Chief Information Security Officer certification. Prior to joining Paychex in September 2019, he served as VP and CISO at a publicly traded company in the HCM industry. Before that, he held security leadership positions at several banks, insurance companies, and professional services firms.

companyName: PAYCHEX INC

ticker: PAYX


text: The Technology Advancement Department of the Company is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Technology Advancement Department is managed by the Board-appointed Chief Information Officer (the "CIO") who reports directly to the Company's Chief Executive Officer. The CIO has more than 12 years of experience with the Company and additional years of experience in the information technology ("IT") field. The CIO also oversees the Company's Cybersecurity Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Cybersecurity Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Technology Advancement Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a monthly basis to the Company's Board of Directors.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: We have established a cybersecurity governance program with clear roles for the executive management team as well as oversight by the Board of Directors and the Audit Committee. The Zoetis information security team provides regular cyber threat intelligence briefings to management and provides updates to our senior executives on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. The Zoetis information security team also works closely with the Zoetis Legal team, including the Chief Privacy Officer, to further enhance incident response procedures. For example, we have a corporate crisis management plan in place to govern our response to corporate crises, which could include cyber incidents, and we conduct periodic simulated programs to ensure readiness. This plan also includes a standard framework for categorization of incidents based on risk level and severity, and requires escalation to Zoetis senior management and/or the Audit Committee of the Board of Directors if certain severity levels are met.

companyName: Zoetis Inc.

ticker: ZTS


text: Our cybersecurity risk management is integrated into our overall risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: Our CISO regularly updates the Audit Committee on our information security program, providing an overview of risks and trends and addressing topics including our incident response plan, cybersecurity threat developments, and the steps we are taking to respond to these matters.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Cybersecurity Incidents Despite our efforts to prevent and mitigate cybersecurity incidents, we cannot guarantee that we, or third -party providers that we rely on, will not experience any breaches, disruptions, or unauthorized access to our information technology systems and networks. During fiscal 2025, we did not experience any cybersecurity incidents that materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, however, there can be no assurance that the measures we have taken to address IT and cybersecurity risks will prove effective in the future. For additional discussion of the IT and cybersecurity risks facing our business, please refer to Part 1, Item 1A, Risk Factors of this Annual Report.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Prevention and Preparation We undertake regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third-party to conduct an external review of our vulnerabilities at least annually. We continue to strengthen our authentication mechanisms including broad adoption of multi-factor authentication and geolocation-based blocking. To support our preparedness, we perform a tabletop exercise at least once a year to test our incident response procedures.

companyName: American Homes 4 Rent

ticker: AMH


text: Our Chief Finance/Information Security Officer has oversight of information security across the organization, with the Senior Technology/Cybersecurity Officer independently accountable for managing our enterprise information security department and delivering our information security program. The responsibility of this role includes cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first and second line of defense functions. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Information Officer. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. To protect against such threats, we employ an array of data security technologies, processes and methods across our infrastructure to protect systems and sensitive information from unauthorized access. We maintain comprehensive identity and access management practices (e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employ a variety of security information and event management tools. Non-technical safeguards also play an important role in our cybersecurity program. We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow-up on matters already reported. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report on Form 10-K.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board maintains principal oversight responsibility for our enterprise risk management, including cybersecurity. The Board has responsibility for, among other things, oversight of the Company's information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats and the steps management has taken to monitor and mitigate such risks. The Board reviews and discusses with management, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks and to remediate the effects of any cybersecurity incidents that may occur.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: We engage in an annual comprehensive Enterprise Risk Management (ERM) process designed to identify and manage risk. Our annual ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level. Our ERM program is overseen by our chief financial officer. Our ERM process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks.

companyName: ONEOK INC /NEW/

ticker: OKE


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see "Risk Factors - An information security breach of our systems or our data centers operated by third-party providers, the loss of, or unauthorized access to, client information, or a system disruption could have a material adverse effect on our business, market brand, financial condition and results of operations."

companyName: Thryv Holdings, Inc.

ticker: THRY


text: In the event of a cybersecurity breach, our readiness, responsiveness and resiliency are critical. As part of our continuing efforts to assess and enhance our readiness and responsiveness, we conduct periodic mock practice scenarios in which participants at various levels of the Company, including members of senior management and IT technical personnel, play out responses to various cybersecurity breach scenarios. Thereafter, we debrief and identify areas of improvement, to continually develop response capabilities and processes that are as efficient and that operate as quickly as possible in the event of a breach, to reduce potential harm that could be caused by inefficiencies and delay. Additionally, we regularly assess our systems' resiliency and recovery capabilities in case of a cybersecurity breach, both self-managed as well as by qualified third parties.

companyName: Sylvamo Corp

ticker: SLVM


text: We also maintain an incident response plan ("IRP") that outlines procedures for responding to cybersecurity incidents, minimizing their impact, and communicating with relevant stakeholders, including regulators, customers, and employees. During a cyber incident, our CIO and network security team assess the severity of the incident and notify key management and (if deemed necessary) our audit committee as promptly as practicable. Our incident plan is reviewed annually and updated as appropriate to address evolving threats and our business conditions.

companyName: HAWKINS INC

ticker: HWKN


text: Risks and uncertainties related to cybersecurity are discussed in greater detail under "Risks Related to Information Technology" in Item 1A of this report.

companyName: Avery Dennison Corp

ticker: AVY


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") program, in which cybersecurity risk is included. Our cybersecurity program is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and leverages International Organization for Standardization and other applicable industry standards. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products. This is supported by our security operating framework, roadmap and governance.

companyName: PENTAIR plc

ticker: PNR


text: The Chief Information Officer and our Chief Information Security Officer also serve on management's Enterprise Risk Committee, along with our executive management team, the Chief Compliance Officer, and internal audit personnel. The Enterprise Risk Committee meets regularly during the year to assess various significant risks—including cybersecurity risks—and receives cybersecurity updates in connection with those assessments and the development and implementation of any risk mitigation plans. Our President and Chief Executive Officer presents the report of the Enterprise Risk Committee quarterly to the full board of directors.

companyName: Enhabit, Inc.

ticker: EHAB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our cybersecurity program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness. Our Chief Information Officer and our Information Security Officer, report directly to our Chief Operating Officer, along with key members of their teams, who collaborate with peer banks and industry groups to review cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership.

companyName: CONDUENT Inc

ticker: CNDT


text: Our information technology ("IT") function manages IT operations and continually evolves our systems to meet the constantly changing digital environment. We enhanced our workstation, server, email security, and network monitoring with managed detection and response and alerting capabilities. We perform periodic cybersecurity risk assessments to identify, assess, and prioritize potential risks to information, data assets, and infrastructure. The Company addresses identified risks and develops and implements controls to mitigate issues. The Company engages third parties in connection with its cybersecurity processes as appropriate. The Company has established processes to identify risks from cybersecurity threats associated with its third-party service providers.

companyName: STONERIDGE INC

ticker: SRI


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CFO, Mr. Ola Soderquist. Although, not ideal Mr. Soderquist brings a certain expertise to his role through his earlier career while working within companies providing cybersecurity.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Management Role in Cybersecurity Risk Management At the management level, our CISO has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at Mondel z and other major consumer goods and financial services companies. Our CISO currently reports to our Chief Information and Digital Officer and has operational responsibility for our information security programs, protections, and efforts, along with leading the team responsible for implementing, monitoring, and maintaining cybersecurity and data security strategy, policy, standards, architecture, and practices across our business. Our CISO is supported by a team of enterprise information system security and risk professionals, including regional information security officers responsible for overseeing cybersecurity strategy and operations in each business unit. Our CISO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data security and cybersecurity risks. Our CISO updates the Management Leadership Team on these matters and works closely with Corporate and Legal Affairs to oversee compliance with legal, regulatory, and contractual security requirements.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: We recognize the importance of maintaining the trust and confidence of our publishers, buyers, partners, customers, and employees. The Audit Committee of our Board ("Audit Committee") is responsible for oversight of the Company's cybersecurity function and efforts, and receives quarterly updates from management regarding the Company's cybersecurity policies, standards, processes, and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity risk management program is overseen by our Senior Vice President, Infrastructure and Security ("SVP Security"), our executive management team, and our Board through the Audit Committee.

companyName: PubMatic, Inc.

ticker: PUBM


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee, and reported to the board. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.

companyName: Federal Home Loan Bank of Atlanta


text: Cyber Threats and Incident Response In the ordinary course of our business, we collect and store confidential data, including intellectual property, proprietary business information and personally identifiable information (including of our employees, customers, suppliers and business partners). We rely extensively on information technology systems, including some systems that are managed by third-party service providers, to securely process, store and transmit such confidential data in order to conduct our business. These systems include programs and processes relating to internal and external communications, ordering and managing materials from suppliers, collecting, processing and storing data produced by our clinical trials and other research and development initiatives, converting materials to finished products, shipping products to customers, processing transactions, processing payments to employees and vendors, calculating sales receivables, generating our financial results for each reporting period, summarizing and reporting results of operations, and complying with information technology security compliance and other regulatory, legal or tax requirements.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Considering the asset, threat, risk-based scenario or vulnerability, and the mitigating factors, a likelihood and impact determination is made to calculate the final risk level. Risk reduction plans are determined and used to prioritize security program initiatives. Risk mitigations are tracked and monitored in a risk register.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our management team is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing the implementation and maintenance of our cybersecurity policies and procedures and activities carried out in furtherance of those policies and procedures. The Senior Vice President of Security leads our cybersecurity risk management efforts and helps us assess cybersecurity risks, establish priorities, and determine the scope and details of our cybersecurity program. We have identified certain members of management and relevant employees to oversee our cybersecurity incident response and vulnerability management processes.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K, and are integrating them into our overall risk management systems and processes by implementing and maintaining various technical, physical, and organizational safeguards, such as policies, standards, and practices relating to: • risk assessments; • incident detection and response; • vulnerability management; • internal controls within our IT, Security and other departments; • network security controls; • access controls; • physical security; • asset management; • system monitoring; • employee cybersecurity awareness and training; • phishing tests; • the use of the internet, social media, email and wireless devices; • firewalls and intrusion prevention systems; • endpoint detection and response systems; and • anti-malware functionality.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: This risk management program addresses, but is not limited to, risks identified by external auditors and assessors, internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. An internal audit team at the Company manages and maintains remediation strategies for identified risks, and reports on them regularly to senior leadership. As part of the Company's cyber risk management program, the Company has engaged external independent assessors to conduct cyber risk assessments, evaluate cyber risk management controls, and report both findings and recommendations to management.

companyName: MACERICH CO

ticker: MAC


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO is a Certified Information Systems Security Professional, Certified Ethical Hacker, a graduate of the Department of Defense Executive Leadership Development Program, a fellow with the American Council of Technology and an adjunct professor at Carnegie Mellon University. He was formerly the CISO at other large financial institutions and a federal agency prior to joining Discover.

companyName: Discover Financial Services


text: We are able to identify cybersecurity breaches through various channels, including but not limited to automated event detection alerts, reports from employees, notifications from external entities such as third-party IT service providers, and proactive threat investigations in collaboration with our external partners. Upon spotting a potential cybersecurity breach, including those involving third-party cyber events, our designated incident response team outlined in the IRP adheres to the policy's protocols to investigate the suspected incident. This investigation entails determining the nature of the event (e.g., ransomware attack or breach of personal data), evaluating the severity of the incident, and gauging the sensitivity of any compromised data.

companyName: Extra Space Storage Inc.

ticker: EXR


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. We partner with the Cybersecurity and Infrastructure Security Agency (CISA), under the Department of Homeland Security, to conduct regular vulnerability scanning against our public facing assets, and on a recurring basis we partner with outside firms to conduct thorough security assessments against our external and internal environment. Results of those assessments are further evaluated, and remediation activity is prioritized.

companyName: WAFD INC

ticker: WAFD


text: Despite our ongoing efforts to continuously improve our ability to prevent and minimize the impact of future cyber incidents, we cannot assure you that we will not be the subject of future threats or incidents. While the February 2023 cyberattack and our remediation efforts have not had and are not expected to have a material adverse impact on our consolidated financial position, results of operations or liquidity, we cannot assure you that in response to a future cyberattack we will be able to restore our systems so quickly and with minimal disruption to our business operations and without incurring material costs. In addition, the mishandling or inappropriate disclosure of non public sensitive or protected information could also lead to the loss of intellectual property, negatively impact planned corporate transactions or damage our reputation and brand image. Misuse, leakage or falsification of legally protected information could also result in a violation of data privacy laws and regulations and have a negative impact on our reputation, business, financial condition and results of operations.

companyName: B&G Foods, Inc.

ticker: BGS


text: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: FARO TECHNOLOGIES INC


text: Our CTO oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO has served in this role at the Company since 2020, and has more than 25 years of experience in the aggregate in various senior roles involving managing global information technology and security teams spanning strategy, implementation, operations and compliance. The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company's technology infrastructure and corresponding safety measures. Our VP of Information Technology Infrastructure has served in this role at the Company for over seven years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Although the size and scope of our operations is limited compared to larger global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition, and results of operations. In that regard, we have increased our investment in information systems by hiring a Director of Technology in 2024 to replace limited outsourced services previously utilized and bolstered our IT department with other hires. In 2024 we evaluated and implemented top tier security enhancements across company data systems in the form of new virus, malware, and ransomware protections, SEIM, email and systems security protections, improved systems management, and email/phishing security training for staff. Additionally completing National Institute of Standards and Technology (NIST) 800-171a enclave assessment and requirements. We are currently working towards CMMC certification and expect to be ready for a third-party assessment sometime during the 2025 fiscal year.

companyName: VirTra, Inc

ticker: VTSI


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks. The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis. These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.

companyName: SWK Holdings Corp

ticker: SWKH


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendor risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Management, along with Vornado, is responsible for assessing and managing our material risks from cybersecurity threats. Management and Vornado have primary responsibility for our overall cybersecurity risk management program and supervise both the internal cybersecurity personnel and external cybersecurity consultants. Vornado's Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.

companyName: ALEXANDERS INC

ticker: ALX


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO review Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Apart from the measures implemented to decrease the possibility of a material cyberattack being successful, we have created clear incident response protocols to deal with any cyber events that may arise. Our program provides for the coordination of different corporate functions and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate any incidents. Testing, training and exercising of our incident response capabilities are carried out routinely and After Actions Reports are prepared to continuously improve these practices. We also have processes to evaluate potential disclosure, comply with applicable legal obligations, and mitigate reputational damage.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, employee training, testing and assessments and a third party risk management process.

companyName: Lemonade, Inc.

ticker: LMND


text: The management of cybersecurity risks is ultimately the responsibility of Company management and is governed by the Board. They devote significant time and attention to the oversight of cybersecurity and information security risks. The Board through its BRC reviews monthly information technology and Information Security and Vendor Management reports that highlight key areas of focus and risk. The Board also reviews and approves the Information Security Program, the central program outlining cyber-security processes and controls annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services.

companyName: Immunocore Holdings plc

ticker: IMCR


text: NSP-Minnesota is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: NORTHERN STATES POWER CO


text: We conduct an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks and address the risks identified.

companyName: PTC INC.

ticker: PTC


text: To encourage consideration of cybersecurity risks across functions, we require employees to participate in annual cybersecurity risk awareness trainings and phishing exercises. Further, we maintain cybersecurity incident response procedures supported by our internal cybersecurity incident management team. The cybersecurity incident management team is comprised of individuals across several areas of the organization – including legal, finance, quality, regulatory, IT, and investor relations. Our cybersecurity incident response program maintains procedures designed to mitigate the harm posed by cybersecurity threat actors as well as to escalate cybersecurity incidents within the organization, if necessary. We engage in tabletop exercises to test our incident response plan.

companyName: Fusion Pharmaceuticals Inc.


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

companyName: EXAGEN INC.

ticker: XGN


text: Vroom's Senior Director, Information Security reports to the Committee on a quarterly basis on our cybersecurity risks. In addition, the Senior Director, Information Security updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Vroom, Inc.

ticker: VRM


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "If we experience a significant disruption in our information technology systems, including our Platinum Analysis Software services, or cybersecurity incidents, our business could be adversely affected", which disclosures are incorporated by reference herein.

companyName: Quantum-Si Inc

ticker: QSI


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO, and our CISO, in consultation with our CIO and CLO, uses the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported periodically to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: The Board oversees the Company's information security program, which includes oversight of the cybersecurity program and management of cybersecurity risks. The Board receives annual updates from the Company's CISO, and/or members of the executive leadership team. Such reports typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans and the evolving cyber threat landscape, and a detailed threat assessment relating to information technology risks. Notice of potential material Incidents to the Board is provided for in the Cybersecurity Incident Playbook (the "Playbook") and the Cybersecurity Incident Disclosure Control Procedure (the "Cyber Disclosure Procedure").

companyName: ROBERT HALF INC.

ticker: RHI


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have no t materially affected us to date, including our business strategy, results of operations, or financial condition.

companyName: Phunware, Inc.

ticker: PHUN


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Governance

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: Partnering with the Cybersecurity and Infrastructure Security Agency (CISA), DHS, and the Federal Bureau of Investigation, to leverage their provided sensitive or confidential threat intel and with CISA for weekly vulnerability scans of our key public-facing servers;

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: The New Manager, through Rithm, takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks. The CISO plays a critical role in protecting the Company's assets, data and reputation by developing a robust security strategy and security awareness. Rithm's current CISO brings over 20 years of experience in IT operations and information security with a proven track record working in large financial institutions, mortgage companies and banks, with expertise in managing complex security environments. The CISO, in conjunction with other executive leaders such as the CIO and the Chief Legal Officer, manages the Company's cybersecurity posture.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems and 24x7 security operations center.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Like many other companies, from time to time, we detect attempts by third parties to gain access to our systems and networks, and the frequency of such attempts could increase in the future. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, there can be no assurance that our efforts to prevent or mitigate cybersecurity incidents will be successful. Please see "Risks Related to Technology and Data Privacy" in "Risk Factors" in Section 1A of this Annual Report on Form 10-K.

companyName: CTS CORP

ticker: CTS


text: GoDaddy's CISO has primary responsibility for overseeing the company's programs for identifying, assessing, and managing the company's cybersecurity risks. The CISO reports directly to the company's CTO and also regularly provides reports and updates to the company's CEO on significant cybersecurity-related matters relevant to the company's cybersecurity risk. The company's CISO has more than 18 years' experience in cybersecurity, networking, and related technologies. The company's CTO has more than 25 years' experience in network security and other related technologies. The company's CEO has more than 27 years' experience in ecommerce technology, engineering, and other related areas.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our capabilities, processes, and other security measures also include, without limitation: • Security Information and Event Management ("SIEM") cloud incident management platform, that provides a log aggregation and analytics solution for threat and vulnerability monitoring. • Endpoint Detection and Response ("EDR") software, which monitors for malicious activities on endpoints. • Cloud Security Posture and Workload Protection (CSPM/CWPP) infrastructure, container, and workload monitoring for threats and compliance posture; and • Corporate incident response plans, including a product security incident response plan. • Supplier Risk Management processes to monitor contractual cybersecurity requirements, assess and manage 3rd party cyber and data risk in service and technical engagements.

companyName: Fisker Inc./DE


text: The Company has an information security policy, and it provides cybersecurity training to employees on a recurring basis. As part of our processes, employees are trained on how to identify and report potential cybersecurity threats. The Company also engages in an ongoing process of risk assessments to identify and mitigate cybersecurity threats. This includes a vulnerability management program where such risks are identified, classified, and addressed. The Company conducts cybersecurity exercises to enhance mitigating controls and incident response preparedness. The Company also has incident response plans in place to address contingencies in the event of a cybersecurity incident.

companyName: MSA Safety Inc

ticker: MSA


text: Currently, we rely on our third party for much of our cybersecurity efforts. Internally, we are working towards formally employing and documenting a risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT")

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than three decades of technology, security and leadership experience across both the public and private sector. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional ("CISSP"). He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.

companyName: KORN FERRY

ticker: KFY


text: Operating System updates and security patches as well as application software updates released by the vendors are reviewed, tested and implemented on a regular basis. Data backup is achieved through hourly incremental backups with replications to off-site locations. User-level access is secured through industry standard encryption and supports accessibility rules including two factor authentication and VPNs. 27001: Certification for information security management systems. 2: Compliance with the AICPA's Trust Service Criteria, demonstrating security, availability, processing integrity, confidentiality, and privacy controls. Compliance with the Health Insurance Portability and Accountability Act for handling protected health information (PHI). Compliance with the General Data Protection Regulation for protecting the privacy and rights of EU citizens' data. DSS: Compliance with the Payment Card Industry Data Security Standard for secure handling of payment card data.

companyName: AIRWA INC.

ticker: YYAI


text: Processes designed to monitor for cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access. These services are designed to monitor for both internal and external threats.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers. Our Director of Information Technology, together with BDO, oversees the third-party managed service provider ("MS Provider").

companyName: LXP Industrial Trust

ticker: LXP


text: The Company's Chief Information Security Officer ("CISO") leads the Company's dedicated information security department, which monitors FOX's prevention, detection, mitigation and remediation efforts related to cyber threats. The CISO regularly consults with the Company's Co-Chief Privacy Officers, and the Company's Chief Technology Officer ("CTO") provides additional oversight of the cybersecurity program, and previously served as the Company's CISO. The CISO has over 15 years of experience in cybersecurity, information security and technology, including a background in broadcast media and networking and systems engineering, and has held numerous industry certifications.

companyName: Fox Corp

ticker: FOXA


text: Computer viruses, malware, phishing attacks, denial-of-service attacks and similar cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.

companyName: YELP INC

ticker: YELP


text: Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.

companyName: FinTrade Sherpa, Inc.

ticker: FTSP


text: The Company has engaged a third-party service provider, Computer Repair Services of Nevada ("CRSN") to assist it in protecting against Cybersecurity risks. CSRN has installed anti-virus and other risk protection software on Company IT systems and keeps these protections updated. The Company also has a written cybersecurity policy that all employees are required to follow that requires employees to maintain strong password control, protect Company devices, avoid suspicious links in emails, and utilize social media only with the consent of their manager, among other things.

companyName: CLS Holdings USA, Inc.


text: Cybersecurity is a critical component of Southern Company's risk management program. The Southern Company system has implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the Southern Company system's ability to fulfill critical business functions, including energy delivery service failures, and on the confidentiality, integrity, and availability of the Southern Company system's information systems.

companyName: SOUTHERN CO GAS


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning financial services, healthcare, and government. The CISO provides regular updates to executive management and ensures independent validation of key controls through internal and external reviews. The CISO's function operates independently of IT operations, with direct access to the Audit and Finance Committee as needed.

companyName: Covista Inc.

ticker: CVSA


text: As we are in the process of hiring a new Director of Information Technology, our Chief Legal Officer is fulfilling these functions in the interim with assistance from third-party information technology and cybersecurity experts. Although our Chief Legal Officer does not have direct cybersecurity expertise obtained through certifications, her experience as a member of our company's senior management team and overseeing enterprise risks, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables her to assess and manage material risks from cybersecurity threats. We maintain an established process to notify management of identified cybersecurity incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.

companyName: Absci Corp

ticker: ABSI


text: Although the "Risk Factors" section includes further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.

companyName: OOMA INC

ticker: OOMA


text: Our CISO works at the direction of the CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers. Prior to joining MPC in 2021, our CDO was employed by GE and its subsidiary companies for over 20 years, holding several executive IT leadership roles with increasing responsibility. He was then named Senior Vice President and Chief Information Officer of Services for parent company GE in 2017 and was later named the Vice President and Chief Information Officer of GE Healthcare. Our CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company's senior leadership in this area have over 75 years of experience. The Company's CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. The Company's CIO has over 30 years of technology executive leadership, technology experience focused on strategy, design, development, implementation and support of application systems, and overseeing transformative technology changes, including digital transformations and fraud and BSA/AML capabilities. While the CIO and information technology organizations collaborate with the CISO organization as described herein, to create independence between the CISO and CIO functions, the CISO reports to the Company's Chief Administration Officer and the CIO reports to the Company's Chief Banking Officer for National Business Lines. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD's Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company's CISO and CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the cybersecurity sub-committee. With over a combined 45 years of experience in the field of cybersecurity, the cybersecurity sub-committee brings a wealth of expertise to their role. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our cybersecurity sub-committee oversees our cybersecurity strategies, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks is discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: Our Chief Security Officer and Chief Information Officer provide quarterly briefings to the Security Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Security Committee provides regular updates to the Board of Directors on such reports. In addition, our Chief Security Officer and our Chief Information Officer provide annual briefings to the Board of Directors on cybersecurity risks and activities.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: In addition, the Company has an incident response plan ("IRP") that is in effect if an event is identified by information technology or information security team or one of our third party vendors. The Company's Information Security Officer ("ISO") would activate the IRP and communicate with the team members in accordance with the IRP. If the incident is material, the Chief Risk Officer would disclose the incident to the management Disclosure Control Committee.

companyName: California BanCorp \ CA

ticker: BCAL