text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS

secItem: Item 1C


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. Cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register and senior management prioritizes our risk management processes and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: GENELUX Corp

ticker: GNLX


text: Furthermore: • Management regularly assesses company risk posture using internal reporting and monitoring tools. • Management develops and implements mitigation strategies that are based on industry best practice. • Management monitors and maintains the effectiveness of the cybersecurity program through penetration testing and regular assessments. The management team also works with external advisors, partners, and auditors for expert guidance on all cybersecurity-related matters. To date, no cyber threats have materially adversely affected the Company.

companyName: Arcadium Lithium plc


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing IT Systems and Confidential Information.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: We use third-party service providers, including cybersecurity consultants, to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, to conduct risk assessments and identify potential risks.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, select members of the Audit Committee and CIO maintain an ongoing dialogue regarding potential cybersecurity threats and mitigation strategies and updates to our cybersecurity posture. The Audit Committee oversees strategic decisions related to our cybersecurity program, offering guidance and approving investments in major initiatives. This ongoing oversight enables cybersecurity considerations to be integrated into our broader strategic planning objectives.

companyName: HUNTSMAN INTERNATIONAL LLC


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."

companyName: Velo3D, Inc.

ticker: VELO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, ransomware or other disruptive attacks from financially motivated bad actors, and third party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further discussion, see "Item 1A. Risk Factors – Risk Management".

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We rely upon technology and information systems to support our mining and business operations globally. These systems may be susceptible to cybersecurity risks including, but not limited to, external attackers, malware, viruses, and unauthorized access to our IT systems. We continuously invest and develop our cybersecurity controls and processes to address these threats and reduce the risk of future breaches and cyber attacks. Risk associated with a cybersecurity incident, impacting our operations, has been integrated into our overall global risk management system and process.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: We use third-party service providers to assist us periodically to identify, assess, and manage material risks from cybersecurity threats, including for example;

companyName: MANNKIND CORP

ticker: MNKD


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that has in the past led to and may in the future lead to exploits, security breaches and service disruption. We also integrate security measures into our digital products and services, although product security risks will continue to evolve and grow more complex.

companyName: DOVER Corp

ticker: DOV


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."

companyName: Aurora Innovation, Inc.

ticker: AUR


text: The board of directors is responsible for oversight of our information security program and fulfills this responsibility through regular reporting and updates provided by the ISSC, members of management and other third parties contracted to assess and test the effectiveness of the Company's information security and cybersecurity program. On a quarterly and as-needed basis the board of directors receives updates on cybersecurity risks and the actions taken by management to monitor and mitigate those risks, including key risk indicators, test results, reporting of recent threats and how the Company is managing those threats, along with pertinent information to allow the board of directors to evaluate the effectiveness of the information security program. In addition, at least annually, the board of directors receives comprehensive reporting from the virtual Chief Information Security Officer ("vCISO") on the overall effectiveness of the Information Security program.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: We leverage ISO 27005, an international standard for identifying, measuring, and assessing cybersecurity risks, as a model for measuring our cybersecurity risk. The ISO 27005 model is periodically refreshed as new cybersecurity risks are identified.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the VP of Technology and Director of IT are responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.

companyName: Origin Materials, Inc.

ticker: ORGN


text: We also have a trained response team lead by the CISO, consisting of key individuals from our finance, operations, risk, compliance, communications, human resources, banking and information technology departments, that is engaged for cybersecurity related incidents where necessary and as appropriate.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Following the completion of the Asset Sale, the Company has been in the process of winding down, liquidating and dissolving all of its business and operations, including transferring the Acquired Assets to Johnson Health Tech, reconciling claims in the Chapter 11 Cases, preparing financial reports, winding down foreign affiliated entities, and preparing for emergence from bankruptcy as contemplated in a liquidation plan filed in the Chapter 11 Cases.

companyName: BOWFLEX INC.


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CIO who reports directly to our Chief Executive Officer. Our CIO has over 20 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CIO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Operations and Security, Senior Director of IT, and Chief Financial Officer.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks. This process is supported by both management, as well as our Board of Directors and our Science and Technology Committee. The current chair of our Science and Technology Committee is a NACD certified cybersecurity expert.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Our cybersecurity practices are led by the CIO, who has overall responsibility for assessing and managing cybersecurity risks, and uses a risk-based methodology to support the security, confidentiality, integrity and availability of information and IT systems. Our CIO has over 30 years of experience in IT delivery, operations, and management, as well as over 15 years' experience leading cyber security requirements for global and publicly traded companies.

companyName: SUPERIOR ENERGY SERVICES INC


text: The COO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The COO oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the information security team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: ExchangeRight Income Fund


text: The CISO and the Chief Information Officer ("CIO"), who oversees the Company's Information Technology functions and reports directly to the Chief Administrative Officer, along with key members of their respective teams, regularly collaborate with peer institutions, industry groups, consultants, and others to discuss cybersecurity trends and issues, emerging risks, and best practices. The information systems and cyber security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: LAKELAND BANCORP INC


text: To aid our cybersecurity risk management strategy, we contract with dedicated third-party firms and assessors to identify risks and threats to our organization. These assessments adhere to leading cybersecurity standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework aligning with industry best practices. To oversee incident response and mitigation we utilize our incident response plan and processes to standardize our processes for assessing, identifying, and managing cybersecurity incidents. This includes a comprehensive reporting structure and analysis processes to provide visibility and determine incident business impact. Were a cybersecurity incident to occur, we have also implemented a cross-functional business team to aid in the determination of incident impact, severity, and materiality, with the support of standing external counsel and third-party incident response advisors. Additional to our third-party incident response advisors and support contracts, we undergo regular penetration tests to bolster our readiness in the event of cybersecurity incidents. Furthermore, we have also obtained cybersecurity insurance coverage to enhance protection and minimize potential financial prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, simulated phishing exercises, incident response tabletops, cybersecurity insurance, and business continuity planning for the protection of the Company's assets. Additionally, the Company's cybersecurity function is audited on an annual basis by internal audit and external regulatory examiners.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: The Cybersecurity Leadership Team regularly informs the cyber task force of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Furthermore, as noted below, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee and, as appropriate, the Board, ensuring that such bodies maintain comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: CubeSmart

ticker: CUBE


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments and policies with respect to the Company's IT systems, privacy, information governance and cybersecurity management. The Audit Committee meets with management at least annually, and as necessary, to review the Company's IT security program, compliance and controls with the CFO & COO and/or CISO, including the potential impact of data privacy risk exposures on the Company's business, financial results, operations and reputation, the steps management has taken to monitor and mitigate such exposures, and major legislative and regulatory developments that could materially impact the Company's data privacy risk exposure.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: Merus N.V.


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: The Company has integrated its cybersecurity program into its overall risk management processes by instituting corporate measures and protocols that apply to ensure ongoing operations in the event of a disaster or major business disruption affecting the corporate headquarters, infrastructure or key personnel. Our employee guidelines also address employee computer usage, including a variety of restrictions and protocols intended to enhance cybersecurity and reduce the risk of a successful cyber-attack.

companyName: EQC Liquidating Trust


text: We require annual training for personnel for information security, including information about the latest cybersecurity threats. To equip employees with the knowledge to identify potential risks with tools to report any suspicious activities, we implemented monthly phishing exercises that encompass various real-life simulations. We also practice scenario-based simulation drills, such as tabletop exercises for employees and contractors, to enhance awareness and vigilance of potential threats. For fast-developing threat situations, we utilize enterprise-wide corporate communication channels to broadcast security alerts for the timely delivery of important information to our employees.

companyName: DONALDSON Co INC

ticker: DCI


text: The Audit Committee of the Board of Directors considers cybersecurity risk and other information technology risk as part of its risk oversight function. Our head of Internal Audit reports directly to the Audit Committee and is responsible reviewing with the Committee our company-wide enterprise risk assessment, which includes an evaluation of cybersecurity risks and threats. In addition, the Audit Committee separately receives regular reports from our Chief Information Officer on, among other things, our cybersecurity risks and threats, the status of projects to strengthen our information security systems, and assessments of our security program. The Chair of the Audit Committee regularly reports to the full Board regarding its activities, including those related to our cybersecurity risk management program.

companyName: Knowles Corp

ticker: KN


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Technology Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert. The ITSC includes multiple members, including the Chief Technology Officer and an outsourced consultant, who serves as the Company's Virtual Information Security Officer.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: We have adopted an Information Security Policy applicable to all of our employees and business partners. We provide security awareness education and training for our employees annually, conduct regular internal "phishing" testing and mandatory training for "clickers," and publish internal alerts to highlight any emerging or urgent security threats. We also maintain a Global Security Incident Response Plan ("GSIRP") to guide our response in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making processes required during a response to a security incident, as well as the reporting protocol with escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We leverage the standards set by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as well as industry best practices to measure our security posture and manage risk. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues, although our insurer may deny coverage for a future claim or our insurance coverage may be insufficient to cover all losses from a cyberattack.

companyName: Envista Holdings Corp

ticker: NVST


text: The Innovation and Technology Committee of our Board of Directors is responsible for overseeing our cybersecurity program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CISO and our CIO provide quarterly reports to the Innovation and Technology Committee regarding our cybersecurity program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Innovation and Technology Committee reviews and approves our cybersecurity and technology budgets and strategies annually. Additionally, the Risk Committee of our Board of Directors reviews key metrics summarizing our cybersecurity risk profile on a quarterly basis. The Innovation and Technology Committee and Risk Committee each provide a report of their activities to our full Board of Directors at each Board meeting.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE CO


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for the day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer is responsible for the day-to-day assessment and management of cybersecurity risks. Our Chief Technology Officer has led our IT department since 2013 and has over thirty years of experience developing and implementing technology and supply chain services. We have implemented a number of processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our Chief Technology Officer and his team shares such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: The audit committee receives quarterly reports from our VP of IT and Facilities concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our vice president of information technology services, who reports to our Chief Strategy Officer. The IT Department's security team, a cross-functional group composed of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: The utility industry has been the target of several cyberattacks on operational systems and has seen an increased volume and sophistication of cybersecurity incidents from international activist organizations, other nation state actors, and individuals. In addition, the advancement of AI has given rise to additional vulnerabilities and potential entry points for cyberattacks. We expect to continue to experience attempts to compromise our information technology and control systems, network infrastructure, and other assets. To date, we have not experienced a cybersecurity incident that has had a material impact on our business or results of operations.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third-party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third-party vendors, that could materially adversely affect our business and financial condition. For additional information regarding whether risks from cybersecurity threats are reasonably likely to materially affect us, see Item 1A, "Risk Factors — Security threats to our information technology infrastructure and/or our physical buildings could expose us to liability and damage our reputation and business " in this Report.

companyName: RenovoRx, Inc.

ticker: RNXT


text: Our Chief Information Security Officer ("CISO") is responsible for Marqeta's information security posture and cybersecurity program. We believe our CISO is qualified to assess and manage our material risks from cybersecurity threats based on 15 years of cybersecurity and risk management expertise as a security and risk management leader at various public and private companies and as a cyber threat intelligence analyst for a branch of the United States military. Our CISO reports to our Chief Product and Technology Officer and oversees a team of cybersecurity professionals in areas including Governance, Risk, and Compliance, Product and Infrastructure Security, Security Operations, and Identity Security.

companyName: Marqeta, Inc.

ticker: MQ


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and any particular incidents through briefings from internal security personnel to Mr. Wan or our management team; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.

companyName: GigaCloud Technology Inc

ticker: GCT


text: We maintain third-party vendor policies and practices to identify, prioritize, and mitigate and remediate third party risk. Third-party access is narrowly limited in scope, granting access only to necessary systems with the lowest level of privileges required. Third-party access is monitored, and accounts are reviewed and attested to on a quarterly basis. TEGNA relies on third parties to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: TEGNA INC

ticker: TGNA


text: Our cybersecurity programs are informed by or aligned to the ISO/IEC 27001 security framework, an internationally recognized standard. As part of our programs, we assess our third-party vendors for relevant risks which may impact the Company.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: We design and assess our program based on the Center for Internet Security Framework (CISF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CISF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: HilleVax, Inc.


text: Company's Chief Executive Officer assesses risks from cybersecurity threats on an ongoing basis. As the Company grows it plans to develop a more robust and detailed strategy for cybersecurity. The Company has not encountered cybersecurity challenges that have materially impaired operations or financial condition.

companyName: Regen BioPharma Inc

ticker: RGBP


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").

companyName: Enovix Corp

ticker: ENVX


text: We have instituted policies and processes dedicated to assessing, identifying, and managing risks from cybersecurity threats. Cybersecurity risks are managed as part of our enterprise risk management program. We are committed to safeguarding our critical information assets and data and have implemented a defense-in-depth strategy that is informed by industry standard cybersecurity frameworks. We benchmark against these frameworks and our internal risk assessment process to inform how we identify, protect, detect, respond to, and recover from risks, threats, vulnerabilities, and cybersecurity incidents across our information assets.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: The audit committee oversees risks from cybersecurity threats as part of its broader risk oversight responsibilities. The board recognizes the importance of cybersecurity in safeguarding the company's assets and operations.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Senior management, including our CIO and CISO, brief the Board on an annual basis on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate business impact (even if the incidents do not rise to the level of being material). Annually, the Board and management participate in a strategy discussion on cybersecurity.

companyName: KFORCE INC

ticker: KFRC


text: In conclusion, our global head of Information Technology regularly updates the Audit Committee and the Board of Directors on cybersecurity threat risks and related matters, ensuring a proactive and informed approach to managing cybersecurity within our organization.

companyName: ARTIVION, INC.

ticker: AORT


text: The Chief Information Officer, or CIO, leads our information security organization responsible for overseeing EverQuote's information security program. Our CIO has over 30 years of industry experience managing risks or advising on cybersecurity matters. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: EverQuote, Inc.

ticker: EVER


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • internal audits; • bug bounties, phishing and penetration tests; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, as well as dedicated and expert incident commander(s) to steer incident response and resolution; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: ServiceTitan, Inc.

ticker: TTAN


text: Our Chief Financial Officer is responsible for assessing and managing cybersecurity risks; however, as a smaller reporting company, we currently do not have a dedicated cybersecurity team. Our Chief Financial Officer reports to the Board regarding financial and operating risks, including cybersecurity risks. Our Chief Financial Officer has experience in managing public companies and assessing financial and operating risks.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: For the year ended December 31, 2024, there have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: LEAR CORP

ticker: LEA


text: The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Our cybersecurity risk management program includes the following: • a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment; • the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • a cybersecurity incident response plan, business continuity plan, and established policies governing cybersecurity risk management at the corporate and property levels; • cybersecurity training for employees and key business partners with access to our systems; • a third-party cybersecurity risk management process for service providers and vendors who access our systems; • requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and • cybersecurity risk insurance. We also seek to engage reputable service providers that maintain cybersecurity programs or controls.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Some of the other steps we have taken to detect, identify, classify and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Conducting security maturity posture assessments, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a regular basis; • Utilizing industry-standard technologies, processes, and capabilities designed to protect our systems and data and detect potential suspicious activity; • Adopting a vendor risk management program, which includes cybersecurity and data privacy audits, classifying vendor, service provider or business partner risk based on several factors and evaluating and monitoring related risk mitigation efforts; • Providing security and privacy training and awareness to our employees; • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training; and • Maintaining cyber liability insurance.

companyName: Hanesbrands Inc.


text: Cybersecurity risk management is integrated into Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' IT security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cohen & Steers' Cybersecurity Management report on cybersecurity risk management and related matters to our audit committee, as part of their ongoing evaluation and oversight of such risk pursuant to non-exclusive authority delegated by the Board.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: To date, Cybersecurity threats, including as a result of any previous Cybersecurity incidents, have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: For a description of the risks from cybersecurity threats that may have a material affect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: All of the Company's personnel are employees of the Manager or one of its affiliates and are subject to the Manager's policies and procedures. Our Manager, through an affiliate, utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Sunrise Realty Trust, Inc.

ticker: SUNS


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data as well as the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analyses regularly.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents. We have experienced breaches of, and unauthorized access to, our internal systems in the past and we believe such breaches and unauthorized access and other incidents may happen again in the future. As of the date of the filing of this Annual Report on Form 10-K, we do not believe these risks from cybersecurity threats, including the results of prior cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, but there can be no guarantee that we will not experience such a security breach or incident in the future. Refer to Part 1, Item 1A "Risk Factors" of this Annual Report on Form 10-K for additional information regarding cybersecurity risks related to our systems, products, and network.

companyName: Cloudflare, Inc.

ticker: NET


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Our overall strategy in combatting cybersecurity risks includes a variety of measures, including: the use of antivirus software, virtual private networks, email security, as well as other software and system-wide measures such as multi-factor authorization to prevent and detect data intrusions;

companyName: MedWellAI, Inc.

ticker: MWAI


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: We have established comprehensive incident response and management plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and management plans address — and guide our employees, management, and Board of Directors on — our response to a cybersecurity incident. In the event of an incident, we intend to follow our incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as the Board of Directors and senior management, as appropriate.

companyName: VirnetX Holding Corp

ticker: VHC


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: The Company has implemented technical safeguards that are designed to defend the Company's information systems from cybersecurity threats. These safeguards include network security capabilities such as firewalls, intrusion prevention and detection systems; endpoint protection capabilities such as anti-malware functionality; and access controls, which are evaluated for accuracy on a quarterly basis. The Company has also implemented email protection to minimize phishing attacks and ensure integrity in digital communications. We baseline our assets according to the technical controls recommended in the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"). • Cyber Intelligence & Continuous Monitoring: The Company has established continuous monitoring of our environment through a third party and receives alerts on threats and policy violations to ensure we meet our 96 hour window to report material matters to the SEC. The Company is a member the Defense Industry Base ("DIB") and receives cyber intelligence based on current threat actors and tactics, techniques and procedures ("TTP's") from the DIB organization, the Federal Bureau of Investigation ("FBI") cyber division, Department of Homeland Security, and the National Security Agency Cybersecurity Collaboration Center ("NSA CCC"). • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts annual tabletop exercises that simulate a cyber-attack to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: Third-party Risk we are aware of the risks associated with third-party service providers, SideChannel, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Information Security Officer ("CISO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: SideChannel, Inc.

ticker: SDCH


text: Board of Directors Oversight of Cybersecurity Our Board of Directors Audit Committee has ultimate oversight of cybersecurity risks. The Committee is composed of independent directors with cybersecurity expertise. Management briefs the Committee on cybersecurity and information security at least annually.

companyName: NVE CORP /NEW/

ticker: NVEC


text: ASB's Management Committee establishes the Bank's strategy and makes risk-informed decisions, which includes assessing and responding to cybersecurity risk. The Bank's Risk Committee of the Board of Directors oversee risks from cybersecurity threats. Oversight includes quarterly or as needed reporting on cybersecurity risk management activities, program maturity, current and emerging cybersecurity risks, and the cybersecurity threat landscape. ASB maintains a cybersecurity program that is integrated into the overall risk management program and is overseen by the Director, Information Security and governed by an Information Security policy, standards and procedures. The cybersecurity program employs a risk-based approach for managing risks through a combination of automated tools, manual processes, and third-party assessments to identify, assess, mitigate and monitor potential cybersecurity risks. In addition to policies, standards and procedures, ASB's cybersecurity program also includes periodic risk and maturity assessments, awareness and training, monitoring, and an incident response plan.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Omeros maintains a cybersecurity risk management program that is designed to assess, identify, manage and respond to risks from cybersecurity threats in a robust manner. This program shares certain common methodologies, reporting channels and governance processes applicable to our management of other risk areas, such as legal, compliance, strategic, operational and financial risk.

companyName: OMEROS CORP

ticker: OMER


text: PetIQ's cybersecurity incident management processes include processes to assess the impact of an incident for reporting purposes, as well as escalation procedures for incidents (based on severity, risk, and impact) that can flow communications and decisions up through the CIO, Executive/Senior Leadership, and the Audit Committee of the Board of Directors as needed.

companyName: PetIQ, Inc.


text: Risk Governance: The Company's cybersecurity program utilizes a cross-functional approach to addressing cybersecurity risks and engages in discussions with the Board (or a committee thereof) and our executive officers accordingly on an as-needed basis. The Company's cybersecurity processes are implemented to help ensure that the Company's cybersecurity practices are aligned with the Company's overall ERM standards and practices. The Company has formed a Cyber Risk Oversight Committee (CROC) to oversee the Company's cybersecurity program. Our CROC, in turn, communicates any unresolved risks to the Company's Enterprise Risk Committee (ERC) and the ERC interacts with the Board, the Audit Committee and executive management on a regular interval, or more frequently (if necessary) in regard to such risks. Currently, the CROC is comprised of representatives of our IT department as well as senior leadership, including all direct reports to our CEO. The ERC is comprised of our Chief Legal Counsel, Senior Director of Global Risk Oversight and various heads of regional or global business units and corporate functions, including but not limited to, IT, finance, accounting, legal, and human resources.

companyName: Vertiv Holdings Co

ticker: VRT


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.

companyName: Ellington Financial Inc.

ticker: EFC


text: The Company's cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third -party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the our day-to-day operations and has implemented a cybersecurity program that applies to us and our operations.

companyName: Willow Tree Capital Corp


text: We are a global data, analytics and technology company. In the ordinary course of business, we collect, process, transmit and store sensitive data, including intellectual property, proprietary business information and personal information of consumers, employees and strategic partners. The secure operation of our information technology networks and systems, and of the processing and maintenance of this information, is critical to our business operations and strategy.

companyName: EQUIFAX INC

ticker: EFX


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee along with our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Marpai, Inc.

ticker: MRAI


text: A cybersecurity incident response plan that includes identification, containment, remediation, align our cybersecurity controls with industry standards and frameworks, including principles derived from the NIST Cybersecurity Framework.

companyName: Eva Live Inc

ticker: GOAI


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Stereotaxis, Inc.

ticker: STXS


text: The Company employs multiple tools and processes for assessing, identifying and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program. When cybersecurity risks are identified through the Enterprise Risk Management program or otherwise, they are reported to relevant business and governance leaders within the Company for appropriate action.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Our security program is built on the following key success factors: tightly controlled access management based on least-privilege authorization, layered defenses, continuous monitoring, vulnerability testing, rapid response, internal and supply chain risk management, strong executive support, and regular development of a security culture. Integration of our compliance command center tool enables continuous monitoring of policy and practices covering service organization control 2 (" SOC 2 ") compliance.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: We provide recurring mandatory information security training (which includes cybersecurity training) to our associates based on access, risk, roles, and behaviors.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Additionally, each business unit is required to maintain an incident reporting process to report significant cybersecurity events to the Company. The Company and its business units discuss and partner with third parties to assess, mitigate, audit, educate, implement, operate, protect, and remediate various cybersecurity related elements.

companyName: Marygold Companies, Inc.

ticker: MGLD


text: Government and Industry Group Engagement We engage with a wide variety of government agencies and industry groups to enable cross-sharing of information and to identify opportunities to improve our security, including active participation in IT Sector Coordinating Councils and attendance at classified briefings and security architecture reviews hosted by the U.S. Department of Energy, the U.S. Federal Bureau of Investigation and DHS. Partnership with these agencies provides us with intelligence on a wide range of critical infrastructure protection and cybersecurity issues as well as an opportunity to exchange best practices.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Our full Board is responsible for the oversight of the Company's operational and strategic risk management processes. Our Board believes that oversight of risk management belongs at the full Board level rather than with any single committee, primarily because of the importance of understanding and mitigating risk to the overall success of our Company. As part of its risk management responsibilities, our full Board provides oversight of the Company's management and mitigation of cybersecurity risks.

companyName: REGAL REXNORD CORP

ticker: RRX


text: Through a combination of security, risk and compliance resources, AB implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Fund, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by AB's Chief Information Security Officer ("CISO") who actively partners with AB's Chief Compliance Officer and Chief Risk Officer and, in turn, the Fund's Adviser, Board and Chief Compliance Officer. Ultimately, we rely on AB's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including AB's Chief Security Officer.

companyName: AB Private Credit Investors Corp


text: Due to the increasing risk of third and fourth-party business relationships, we implemented a Third-Party Risk Management ("TPRM") Program to evaluate and monitor our network of external partners, vendors, suppliers, and service providers. Capabilities of our TPRM program include continuous monitoring of third parties, secure vendor remote access, and security architecture to protect against cyber threats introduced through other business-to-business ("B2B") system integrations. In addition to above, we have implemented and maintained the following cybersecurity measures as part of our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K): • Security Operations Program - a security operations program to bolster real-time cybersecurity incident detection and response capabilities; • Security Control Framework - a security control framework that aligns with industry accepted best practices and prioritizes implementation of critical cybersecurity controls; • Incident Response Plan - a cybersecurity Incident Response Plan, designed to effectively address cybersecurity incidents while promoting cross-functional coordination across the organization; • Tabletop Exercises - periodic internal and vendor-led tabletop exercises to assess the effectiveness, relevance, and completeness of the Incident Response Plan; • Assessments - annual cybersecurity assessments, which focus on identifying and remediating vulnerabilities that present the most significant organizational risks; • Training - security awareness training for all salaried personnel that highlights critical organizational risks through quarterly phishing simulation campaigns, "lunch and learns", monthly communication updates, and regular cybersecurity learning modules; • Insurance - cybersecurity insurance policies and periodic reviews of our policies and coverage levels; and • Monitoring Legal/Regulatory Developments – review of emerging data protection, data privacy, and other relevant cybersecurity laws and regulations to determine appropriate changes to cybersecurity controls and processes.

companyName: Enpro Inc.

ticker: NPO


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. In addition, our VP of Enterprise Security & Compliance and Director of Enterprise Security & Compliance brings extensive expertise in risk assessment and management, regulatory compliance (including PCI DSS, GDPR, and the Sarbanes-Oxley Act), incident response, data protection and privacy, security monitoring and threat intelligence, and the implementation of advanced security technologies.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: Executive management fosters a cybersecurity threat awareness and risk mitigation culture by supporting regular educational phishing simulations and advocating the importance of cybersecurity in communications to employees. We maintain information security policies to promote employee use of our information technology in a safe manner that helps protect our systems and data from cybersecurity events, and we require periodic enterprise-wide security training and testing and analyze test results.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company has adopted and maintains written policies and procedures for the protection of Company's information systems and nonpublic information stored on those systems, which are based on the Company's risk assessment and that address all other specific topics as may be required by applicable laws and regulations. The Company requires all team members with access to any of its information systems, including contractors, to complete social engineering, cybersecurity, and compliance training programs annually.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Steering Committee oversees and establishes the parameters of our engagement with these experts to ensure we obtain supplement assistance needed in this area, if any.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Cybersecurity Governance Structures Management's Role in Managing Cybersecurity Risk We are committed to protecting sensitive information and have a dedicated cybersecurity group within our IT department that is overseen by our Chief Information Officer. This group provides a quarterly cybersecurity report to our senior management, including the Chief Executive Officer, President, Chief Financial Officer, Chief Operating Officer, Chief Administrative Officer, Chief Information Officer, General Counsel, business segment Presidents and the Vice President—Corporate Security. This senior management team is involved in all significant cybersecurity decisions, including efforts undertaken to comply with the security directives issued by the TSA. Our Chief Information Officer and, occasionally, our Chief Executive Officer and our General Counsel have attended classified briefings on cybersecurity in Washington, D.C. In addition to the quarterly reports to senior management, the cybersecurity team prepares broader management briefings that include updates regarding company-wide cybersecurity matters and initiatives and provide a forum for discussing data security risk solutions and formulating action plans.


text: We are regularly the target of attempted cyber attacks and such prior incidents have not had a material affect on our business strategy, results of operations or financial condition. We anticipate that we will continue to be subject to such attacks. Our security programs and measures do not prevent all intrusions and the occurrence of a significant cybersecurity incident could have a material adverse effect on our business, financial condition or results of operation. See Item 1A. Risk Factors — Technology and Cybersecurity Risks for additional discussion.

companyName: StoneX Group Inc.

ticker: SNEX


text: The manner in which we store and/or transmit sensitive data in connection with our research and development and our day-to-day operations. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.

companyName: Cavitation Technologies, Inc.

ticker: CVAT


text: Our process also addresses material risks from cybersecurity threats associated with our use of third -party service providers, including those in our supply chain, our product development partners, or those who have access to sensitive data or our systems. Third-party risks are included within our broader overall risk assessment process, and cybersecurity considerations are considered during the selection and oversight of our third -party service providers.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Management's Roles and Responsibilities In collaboration with the ERM team and the Audit Committee, the Company's Information Security Team, overseen by the CISO, is responsible for assessing and managing cybersecurity risks including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The Information Security Team is comprised of various IT groups with the knowledge and expertise needed to execute the technical aspect of the Incident Response Plan. This team is led by the CISO and other technical leaders with significant experience in the information security field. The CISO has over 18 years of experience serving as a CISO and in other security leadership positions in the information security and cybersecurity fields, including roles as VP of Information Security, Director of Infrastructure, Director of Information Security, and Manager of Information Security. In addition to his work experience, the CISO holds a certification as a Certified Information System Security Professional (CISSP). The CISO works closely with other management positions, including the Chief Accounting Officer, Chief Information Officer, Chief Audit Officer, Deputy General Counsel, and VP of Investor Relations through the Cybersecurity Incident Committee in order to ensure that the Company has effective communication and understanding of its cybersecurity risk management.

companyName: ModivCare Inc

ticker: MODVQ


text: Our technology platform and other information systems are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices. We are currently pursuing a SOC 2 Type 2 Report, and are working to achieve alignment with the National Institute of Standards and Technology ("NIST") 800-171 Cybersecurity Framework.

companyName: MediaAlpha, Inc.

ticker: MAX


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We may be subject to risks related to security breaches," which should be read in conjunction with the information above.

companyName: Gold Flora Corp.

ticker: GRAM


text: The CCO is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection and mitigation and remediation of cybersecurity incidents and supervising such efforts.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: Our CISO has served in various roles in risk management and enterprise and cybersecurity for over 20 years, including serving as Deputy CISO at a global cybersecurity software company. Our CISO has attained numerous professional certifications, including Certified Information Systems Security Professional, Certified in Risk and Information Systems Control, Certified Information Security Manager, Certified Information Systems Auditor, and GIAC Security Operations Manager. Our CEO, who has decades of software engineering experience, has served as our CEO and as a member of our Board for thirteen years, during which time he has overseen our ERM program, including risks arising from cybersecurity threats. Our CFO and General Counsel each have more than 20 years of experience managing risks, including both at the Company and with other public companies. The other members of our Executive Steering Committee are all experienced leaders in their respective areas of management with extensive SaaS operational experience.

companyName: PROS Holdings, Inc.


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training. Our teams evaluate the risk profile of third-party service providers, considering key risk factors such as cybersecurity measures, data privacy policies, and regulatory compliance. We maintain communication channels with key third-party service providers to assess and respond to potential impacts of incidents within a service provider's organization. We rely on our third parties to communicate such incidents to us in a timely manner. Beyond cybersecurity assessments, our teams conduct a structured due diligence process as part of our vendor compliance program for third-party providers that meet specific criteria set by us. We use third-party risk management services to evaluate additional risk factors, including but not limited to past or pending litigation, criminal history, derogatory information, and financial stability.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: Our management team, including the Director of Information Technology, Chief Operating Officer, Chief Financial Officer, and Principal Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team collectively has over 30 years of experience managing cybersecurity risks and is knowledgeable about our products and systems.

companyName: LENSAR, Inc.

ticker: LNSR


text: Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: Investing in threat intelligence platforms and participating in financial services industry and government forums which track and report on cyber and other information security threats; Routinely performing vulnerability tests;

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: We retain a chief information consultant and a third-party security management vendor to help identify, assess and manage our cybersecurity threats and risks. These partners identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, automated tools, cybersecurity threat subscription services, threat report analysis, internal and external audits, and threat and vulnerability assessments.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: Our VP of IT semi-annually and on an ad hoc basis presents directly to the Audit Committee on cybersecurity initiatives, efforts, and security risks. The Audit Committee reports to the Board at least semi-annually on our cybersecurity initiatives, efforts and security risks. In addition, we have an Incident Response Policy in place to inform senior management and the Board of material issues related to cybersecurity matters and to develop an appropriate response plan.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our Board of Directors oversees our cybersecurity and data protection strategy and appoints a director to lead the Board's efforts. Our Board is briefed on our cybersecurity posture, current and future risks and potential incidents or vulnerabilities on a quarterly basis. Board members and executives participate in engagements on cybersecurity, such as simulated cyber incident response and crisis management exercises. Our Board also regularly receives and reviews third-party cybersecurity assessments, which include assessments of our cyber maturity and cyber risk.

companyName: LITHIA MOTORS INC

ticker: LAD


text: As part of our risk management framework, we regularly assess whether any cybersecurity incidents, or the likelihood of such incidents, could materially affect our business. We are also committed to continuous improvements to address emerging threats. Governance.

companyName: cbdMD, Inc.

ticker: YCBD


text: Chubb management continues to prioritize investments in cybersecurity to protect the confidentiality, integrity, and availability of our data. In accordance with our cybersecurity risk assessment processes, we have deployed a set of cybersecurity controls to protect Chubb. We also maintain a data security incident response plan, applied at an enterprise level, to facilitate our ability to rapidly detect and address data security incidents with the goals of: (i) minimizing risk to data and systems; (ii) quickly recovering and resuming operations; (iii) where applicable, providing timely notice of an incident to regulators and providing timely notice and remediation services to affected individuals; (iv) minimizing potential brand damage; (v) managing litigation, investigations, and disputes that may arise in the aftermath of an incident; and (vi) identifying opportunities to enhance Chubb's data security approach. Consistent with our incident response plan, the CISO informs the Chief Privacy Officer, who is a member of our legal team, and they notify other members of management of significant cybersecurity incidents and provide them with regular updates on the status of such incidents, including mitigation, remediation, and steps to avoid recurrence.

companyName: Chubb Ltd

ticker: CB


text: Members of our management team, most notably our Chief Financial Officer, who has responsibility for managing our Information Technology and Security functions, are responsible for leading our cybersecurity program. Our management team meets regularly with our information technology leadership personnel, including our Head of Information Technology, who reports to our Chief Financial Officer, to receive updates and data on cybersecurity management activities, including assessments on emerging technologies and evaluations of recommended practices related to cybersecurity measures. Our Head of Information Technology, who has managed information technology services and security for over 25 years, and our Chief Financial Officer maintain their expertise through participating in events such as continuing education and training, and information-sharing collaborations. We also retain a third-party Information Security consulting firm to advise on and assess our cybersecurity processes on an ongoing basis.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our trust account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any material cybersecurity incidents since our Initial Public Offering.

companyName: bleuacacia ltd


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and systems along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations. These processes include plans to be used in the event of a cybersecurity incident, including incident reporting and business continuity. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We store our data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. Although we have experienced cybersecurity incidents in the past, cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Risks that could affect us are an integral part of Board and Audit Committee deliberations throughout the year. The Board has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee of the Board has been delegated the authority to oversee and periodically review the security of CQP's information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with the management of CQP's general partner its cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates the Audit Committee on the overall status of its cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.

companyName: Sabine Pass Liquefaction, LLC


text: The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: our third line of defense is comprised of: • Internal Audit: Our internal audit team provides independent and objective assurance to senior management and to the Board of Directors that our cybersecurity and technology risk management processes are designed and working as intended.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our Vice President of IT reports to the Chief Financial Officer and leads our IT and cybersecurity functions and has primary responsibility for leading our overall cybersecurity risk management program, supervising both our internal cybersecurity personnel and our external cybersecurity service providers. Our cybersecurity function is responsible for assessing and managing our material risks from cybersecurity threats, as well as informing management about and monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers and alerts and reports produced by security tools deployed in the IT environment. Our Vice President of IT has significant global experience in managing and leading information systems and deploying cybersecurity technologies and holds a cybersecurity certification from a leading cybersecurity training and research institute.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: Our chief executive officer and directors are responsible for assessing and managing cybersecurity risks, but our officers and directors do not have specific cybersecurity expertise. We believe that once the Company commences operations, cybersecurity will represent an important component of the Company's overall approach to risk management and oversight.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: Management Team Our cybersecurity and information security program, which includes data privacy, is the responsibility of our Chief Information Security Officer ("CISO"), who oversees our global information security program. Our current CISO has served in various information technology and information security roles over the past 20 years including roles at Netflix, Salesforce and Facebook, and has served as CISO since February 2024. He also has relevant degrees and certifications, including a Master of Science degree in Information Assurance from Iowa State University. The information security program has been built over the last 10 years under the leadership of experienced Information Security professionals.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: Crescent's Head of Information Technology has over 30 years of experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Our CCO has over 15 years of experience advising on and managing compliance risks, including those related to cybersecurity, and developing and implementing policies and procedures to address such risks. Team members who support our information security and compliance programs also have relevant educational and industry experience.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including (i) our CTO, Vaidyanathan Raghavan, who previously served as the General Manager of Technology at Wayfair and holds a Master of Science in Electrical Engineering degree from the University of Minnesota; and (ii) our Vice President of Information Technology and Security, Mr. Brendan Hamilton, who has previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues and is a Certified Information Systems Security Professional.

companyName: Xometry, Inc.

ticker: XMTR


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees in sensitive job categories must take and pass rigorous information security and protection training.

companyName: BIO-TECHNE Corp

ticker: TECH


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. We have also partnered with an industry expert's incident response group to help deconstruct, manage and mitigate impact from any cyber-related incident. We also purchase insurance to help protect us against the risk of cybersecurity breaches.

companyName: Summit Materials, LLC


text: Schwab's corporate cybersecurity program is led by our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). The current CISO has been in his role for several years, and is responsible for our overall cybersecurity strategy, security engineering, security operations, cyber threat detection and incident response, and technology risk and compliance. Our CISO has extensive experience assessing and managing cybersecurity risk, and is supported by a cybersecurity organization comprised of hundreds of professionals, many of whom hold various certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information System Control. Our CISO and CIO regularly review our cybersecurity program and our prevention, detection, mitigation, and remediation efforts with management level risk committees and the Board Risk Committee, and we maintain a process for timely escalation of significant risk events to senior management and the Board.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors under the heading "Risks Relating to Our Operations".

companyName: Autodesk, Inc.

ticker: ADSK


text: The governance of cybersecurity risks is a critical function of our Board of Directors which has a key role in the oversight of cybersecurity and related technology risks. The Board of Directors is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: Idaho Copper Corp

ticker: COPR