text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes to our processes to comply; b. Conduct periodic customer data handling and use requirement training for our employees;

companyName: SEKISUI HOUSE U.S., INC.


text: Addressing cybersecurity risks requires ongoing monitoring and vigilance, and the Company is making enhancements to its cybersecurity policies, procedures and practices to safeguard sensitive information as well as information from our partners, customers and employees. We employ a risk-based strategy focused on safeguarding critical assets by implementing controls around access, data, and infrastructure security to protect the confidentiality, integrity, and availability of our data. Maturation and refinement of the Company's cybersecurity risk management strategy and related procedures is a continuous activity to ensure appropriate identification, assessment, and response to risks from cybersecurity threats that may adversely impact our operations. Our employee training and awareness programs are in place to improve cybersecurity awareness throughout the organization and we are committed to educating our employees on best practices for data protection and phishing awareness. We also engage with third-party cybersecurity assessors, consultants, and auditors that provide independent assessments of our systems and processes, contributing to our efforts to strengthen our cybersecurity posture and enhance our defenses.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM

secItem: Item 1C


text: The damage or disruption to our or third-party systems, or unauthorized access to, or exposure of, intellectual property or personal or confidential information, could harm our operations, reputation and brand, resulting in a loss of business or revenue. It could also subject us to government sanctions, litigation from candidates, contractors, clients, and employees, and legal liability under its contracts, resulting in increased costs or loss of revenue. We may also incur additional expenses, including the cost of remediating incidents or improving security measures, the cost of identifying and retaining replacement vendors, increased costs of insurance, or ransomware payments.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Cybersecurity risk management is part of the Company's overall risk management. Our cybersecurity risk management is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third party service providers. Our primary third party service providers, utilize two (2) factor authorization as well as login and password protections with email verifications.

companyName: ECD Automotive Design, Inc.

ticker: ECDA


text: Cybersecurity is an integral part of risk management at Nasdaq. The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, and mitigation of the effect any such incidents may have on us. We use a cross-departmental approach to assess and manage cybersecurity risk, with our Information Security; Legal, Risk and Regulatory; and Internal Audit functions presenting on key topics to the Audit & Risk Committee, which provides oversight of our cybersecurity risk. Additionally, members from these organizations, along with Finance and Accounting, comprise a rapid response team that would mobilize in the event of a significant cybersecurity incident and would analyze and evaluate the incident while also advising the executive management team. Our Global Risk Management Committee, which includes our Chair and CEO and other senior executives, assists the Board of Directors in its cybersecurity risk oversight role.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Our Board of Directors oversees significant cybersecurity risks to the Company directly and through its Audit Committee. The Board of Directors meets with our CSO or his delegate annually to review significant cybersecurity risks as well as cybersecurity priorities and focus areas for the upcoming fiscal year. The Audit Committee meets with our CSO or his delegate quarterly to review significant cybersecurity incidents and risks, as well as progress made towards key cybersecurity initiatives and matters. The CSO may provide more frequent updates to the Board of Directors and Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to our Board of Directors regarding the committee's oversight of cybersecurity risk matters.

companyName: Dell Technologies Inc.

ticker: DELL


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our organization. For additional discussion related to the Company's consideration of cybersecurity risks and their potential impact on our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A. "Risk Factors" in this document.

companyName: ALASKA AIR GROUP, INC.

ticker: ALK


text: Our Chief Information Officer ("CIO") and CISO provide cybersecurity updates to the Audit Committee three times each year and the Board at least annually. These updates cover various topics, including information relating to cybersecurity strategy, program management, and performance trends. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee and the Board of Directors.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: We rely on information technology ("IT") systems to conduct business, including but not limited to, interacting with customers and suppliers, fulfilling orders, generating invoices, collecting and making payments, fulfilling contractual obligations, communicating with internal and external stakeholders, and maintaining our business and financial records. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms, some of which are managed, hosted, provided and/or used by third-parties or their vendors. As a result, the Company is subject to various risks related to vulnerabilities, threats and attacks on these IT systems. See Item 1A, "Risks Related to the Company – "Our business may be subject to system interruptions, cyber security breaches and unauthorized data disclosures." under Item 1A. Risk Factors for additional discussion of these risks.

companyName: Sotera Health Co

ticker: SHC


text: Our Board of Directors (Board) considers cybersecurity and other information technology risk as part of its risk oversight function. The members of our Board hear presentations on our cybersecurity risks and risk management on an annual basis from D.R. Horton's CIO and CSRO. These presentations include reviewing current trends, processes and systems used to mitigate the risk of cybersecurity threats. Our internal audit department also conducts cybersecurity reviews as part of its audit procedures and presents any findings to the Board. We have protocols by which certain cybersecurity incidents would be escalated within the Company and, where appropriate, reported to the Board in a timely manner.

companyName: Forestar Group Inc.

ticker: FOR


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Role of the QVC Group Board of Directors The QVC Group board of directors has overall responsibility for risk oversight and has delegated to its Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. QVC Group's audit committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the audit committee, QVC Group's board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events are brought to the attention of QVC Group's board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: QVC INC

ticker: QVCD


text: The Company's Chief Information Security Officer (CISO), in coordination with the Company's Chief Litigation Officer, Executive Director, Privacy Officer, Corporate Controller/Chief Accounting Officer and other internal stakeholders, is responsible for leading the team responsible for assessing, identifying and managing cybersecurity and data privacy risks, including implementation of our cybersecurity risk management program. The CISO has extensive experience working in the IT and services industry and is a subject matter expert in varied topics including cybersecurity, data integrity, IT risk, enterprise architecture, third-party risk, threat intelligence, incident response, and regulatory compliance. Management committees consisting of senior officers of the Company regularly receive briefings on cybersecurity matters, who in turn regularly report to the Board of Directors and its committees on such matters.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: We engage third-party vendors, assessors, consultants, auditors, and other third-party service providers. We recognize that third-party service providers introduce risk from cybersecurity threats. In an effort to mitigate these risks, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require third-party service providers to adhere to certain security standards and protocols.

companyName: Vital Energy, Inc.

ticker: VTLE


text: We recognize the critical importance of developing, implementing, and maintaining proactive cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. To that end, we engage in the following cybersecurity risk management principles:

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Our enterprise cybersecurity program is led by the CSO, who brings more than two decades of cybersecurity leadership experience and oversees both information technology and information security functions. In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas: • Threat & Vulnerability Management: We follow a defense-in-depth security model with a Joint Security Operations Center, Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack. • Governance, Risk, and Compliance: Our Security Governance, Risk, and Compliance team helps drive trust, compliance, and data protection by managing risks, including supply chain risks, to strengthen customer confidence, support innovation, and protect our reputation. • Fraud Prevention: Our Fraud Strategy and Prevention team seeks to employ industry best practices of fraud prevention, identity and access management ("IAM"), and cybersecurity monitoring to protect the transactions of our members and Clients. We continue to invest in people, processes, and technology solutions to enhance our fraud prevention program. • Security Engineering & Architecture: Our Security Engineering & Architecture team designs and implements resilient security solutions, embedding security into cloud and on-premise environments while automating controls and integrating security into development lifecycles. • Identity & Access Management: Our IAM team enforces zero trust principles, least privilege access, and adaptive authentication, managing multi-factor authentication, privileged access management, and just-in-time access to protect critical systems while ensuring seamless and compliant user access.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: The key features of the Program include: • A cybersecurity incident response team under the CISO's direction, which is responsible for monitoring and responding to threats, vulnerabilities, and incidents. • An incident response plan that is managed by the CISO and the Chief Privacy Officer and tested through cross-functional annual exercises in various geographical regions of the Company, many of which include participation from senior executives and the Board of Directors. • Information security policies and procedures that are reviewed at least annually and updated to reflect applicable changes in law, technology, practice and emerging threats. • Regular network and application testing and surveillance. • Periodic review of threats, vulnerabilities and other cybersecurity risks, internal and external. • Risk mitigation strategies, including annual internal and third-party risk assessments, as well as cybersecurity and privacy liability insurance intended to defray costs associated with an information security breach. • Vendor management procedures designed to identify and address potential risks associated with the use of third-party service providers. • Employee training programs on information security, data security, and cybersecurity practices and protection of data against cyber threats, at least annually. • A cross-functional approach to addressing cybersecurity risk, with participation from Global Technology & Operations, Risk, Compliance, Legal, Privacy and Internal Audit functions.

companyName: METLIFE INC

ticker: MET


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The forensic investigation of the 2025 Cybersecurity Incident is complete and determined that between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company's systems and may have acquired certain data. While we have identified the likely scope of the incident, the full operational and financial impacts are still being evaluated. Accordingly, we have not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company. Further, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.

companyName: Inotiv, Inc.

ticker: NOTV


text: We acknowledge that the absence of comprehensive cybersecurity processes could potentially expose the company to risks, which may materially affect our operations, financial condition, or strategic decisions in the future. We are committed to improving our cybersecurity posture as our resources allow.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.

companyName: Guardant Health, Inc.

ticker: GH


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Silence Therapeutics plc

ticker: SLN


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Certain key controls considered through Coronado's internal control processes are linked to cybersecurity these include controls over access and change management for key financial systems. Where the management parties, the controls.

companyName: Coronado Global Resources Inc.

ticker: CODQL


text: We actively monitor the bulletins that may be issued by National Cyber Security Bodies, which are a good source of information on current trends and methods relating to cyber-attacks. We review this information and adapt our business practices as may be prudent and feasible.

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: Depending on the nature of the services provided the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NGM BIOPHARMACEUTICALS INC


text: We use third party systems and software and provide personal information about customers and employees to third parties in certain cases. We assess the cybersecurity of third party service providers and regularly conduct access review. We may decline or terminate the engagement with certain third party service providers if we determine that the use of their services would increase our exposure to cybersecurity risks.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as the Companies' operations, compliance, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to the Companies' executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The audit committee receives periodic reports from management on our cybersecurity risks. In addition, management alerts the audit committee of any material cybersecurity incidents. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity. Board members receive presentations on cybersecurity topics from management and have available to them external resources related to cybersecurity as part of the board of directors' continuing education on topics that impact companies similar to ours.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Many of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, our ability to keep our business operating is highly dependent on the proper and efficient operation of IT service providers, and our vendor management process is an important part of our risk mitigation strategy. In particular, we obtain reports from our vendors handling sensitive data as to their efficacy and efficiency in managing cybersecurity issues and follow-up with them on any potential or actual issues.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Our Head of IT periodically reports to our CFO on matters relating to our overall cybersecurity risk management program and, in the event of a cybersecurity incident, reports directly to our entire Risk and Compliance Committee. The CFO reports on the cybersecurity risk management program to the other members of our Risk and Compliance Committee and, alongside our General Counsel, provides quarterly cybersecurity risk management briefings to the audit committee, including discussion of cybersecurity risks, that include any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and other matters relevant to our overall cybersecurity risk management. Our audit committee provides quarterly updates, as appropriate, on the cybersecurity risk management program, to our full board of directors.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness.

companyName: FNB CORP/PA/

ticker: FNB


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • people – security awareness education and readiness-testing throughout the year for employees; • process – incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • technology – investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Trust Series, including its business strategy, results of operations, or financial condition.

companyName: United States Commodity Index Funds Trust

ticker: USCI


text: Our board of directors (the "Board") considers cybersecurity risk as part of its risk oversight function. While delegated to the Audit Committee, the Board directly oversees management's implementation of our cybersecurity risk management program. The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Board members receive presentations on cybersecurity topics from our Chief Information Officer. management team, including our Director of IT, is responsible for assessing and managing our material risks from cybersecurity threats.

companyName: CALLAN JMB INC.

ticker: CJMB


text: Material cybersecurity risks are identified by members of our team. Our Head of IT is primarily responsible for managing our cybersecurity risk assessment processes, including those described in "Cybersecurity Risk Management and Strategy" above, our security controls and our response to cybersecurity incidents, with assistance from third party service providers.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: Cybersecurity Strategy, Policy and Procedures We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined within Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We utilize information technology ("IT") that enables our teams to access both operational and financial performance data in real time, while at the same time, helping to identify and prevent cybersecurity threats and risks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: The LCO Committee is charged with, among other responsibilities, reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Further, the LCO Committee receives periodic reports on cybersecurity risks and management of those risks from our Senior Director of IT Governance, Risk and Compliance ("Senior Director"). The Senior Director's presentations to the LCO Committee include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Governance & Personnel Our Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates our information security strategies to ensure effectiveness and, if appropriate, may also include a review from third-party consultants and experts. Senior management updates the Board and Audit Committee on matters regarding information security policies and procedures and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for our risk management oversight.

companyName: INSEEGO CORP.

ticker: INSG


text: The Audit Committee oversees cybersecurity risks. The Audit Committee reviews the Company's cybersecurity program, including the review of reports on cyber incident response processes, emerging cybersecurity developments and threats, and cyber risk assessment. The Audit Committee meets regularly with management to discuss our cybersecurity program.

companyName: V2X, Inc.

ticker: VVX


text: In accordance with the Securities Exchange Commission ("SEC") rules, the Company is required to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 26 years. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: The Company maintains an Information Security Incident Response Policy ("Incident Response Policy") and related procedures that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team and to the appropriate regulatory and governmental authorities. As needed, the notification may include the CEO and/or the Company's and Bank's Board of Directors. The Incident Response Policy and procedures are coordinated through the Chief Risk Officer and key members of management are embedded into the procedures by their design. The Incident Response Policy facilitates coordination across multiple parts of the organization and is evaluated at least annually.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: The Adviser tests its cybersecurity defenses regularly through automated and manual vulnerability scanning to identify and remediate critical vulnerabilities. In addition, it conducts tests to validate its security posture. Further, the Adviser engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by the Adviser's information technology security team in collaboration with outside service providers as appropriate and includes members of the Adviser's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that the Adviser experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to the Adviser's internal exercises to test aspects of its cybersecurity program, the Adviser periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of the Adviser's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: To ensure the integrity and security of our operations, we have implemented stringent processes to evaluate third-party service providers and vendors that have access to sensitive systems, as well as company and customer data. This evaluation may include due diligence procedures such as assessments of the service provider's cybersecurity posture or recommendations for specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood. These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: TRANSCAT INC

ticker: TRNS


text: Gap Inc.'s Chief Information Security Officer ("CISO") oversees the cybersecurity program. The CISO reports to the Chief Technology Officer ("CTO") and is responsible for assessing and maintaining the Company's cybersecurity risk management processes. The CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO, CTO, and members of the Information Security, Information Technology, and Privacy teams have broad experience and expertise in selecting, deploying, and operating cybersecurity technologies, initiatives and processes around the world. Our CISO has nearly 25 years of experience in the information security and information technology fields. Our CTO has nearly 35 years of experience in these fields, including in technology leadership roles for large companies across multiple industries.

companyName: GAP INC

ticker: GAP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program, which is based on recognized industry standards and frameworks, is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Consolidated Communications Holdings, Inc.


text: Our Information Technology (IT) team is responsible for our cybersecurity monitoring and leverages a 24x7 Managed Detection & Response (MDR) third-party vendor to provide real-time cybersecurity threat monitoring and incident response, as well as to conduct a quarterly risk assessment. Pursuant to our incident response policy, any identified cybersecurity threats are immediately evaluated for the level of potential risk to us, with our response and remediation plan based on the potential severity of the incident. This incident risk assessment is continuously updated as we become aware of any new information regarding an identified incident. Pursuant to this plan, we will also utilize third-party experts to help identify, contain and remediate any incident that could have a significant impact on us. In addition, we use third-party experts to assist us in performing annual penetration testing and active breach assessment simulations to verify implementation of security tools, mitigating controls, and our ability to respond to real-world scenarios pursuant to our incident response policy.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management.

companyName: BTC Digital Ltd.

ticker: BTCT


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Oruka Therapeutics, Inc.

ticker: ORKA


text: Abbott has two cross-functional senior management-level committees that assess Abbott's material risks from cybersecurity threats – one that oversees Abbott's cybersecurity program and another that oversees the cybersecurity incident response process.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: We have not identified any cybersecurity incidents that individually, or in the aggregate, have materially affected or are reasonably likely to materially affect the Company. Regardless, we recognize cybersecurity threats are ongoing and evolving, and there can be no guarantee that we will not be subject to a cybersecurity incident that has a material effect on our business. Please consult the "Risks Related to Our Technology" section within Part I, "Item 1A. Risk Factors" for more information about the risks associated with cybersecurity.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: OTEC board of directors oversees our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, the OTEC board receives any updates from management on the primary cybersecurity risks facing us, the Sponsor and our affiliates, and the measures we, Sponsor and our affiliates are taking to mitigate such risks. In addition to such, the OTEC board receives updates from management as to any changes management becomes aware of, such as to changes to such cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow the necessary steps related to incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the OTEC board, as appropriate.

companyName: OceanTech Acquisitions I Corp.


text: Air Wisconsin works closely with accredited third-party cybersecurity firms to audit its security architecture. Air Wisconsin's Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing its cybersecurity risk assessment processes, its security processes, and its response to cybersecurity incidents. For the year ended December 31, 2023, Air Wisconsin has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect it, including its operations or business strategy or our results of operations or financial condition. Air Wisconsin faces certain ongoing risks from cybersecurity threats that, if realized, could materially adversely affect it, including its operations or business strategy or our results of operations or financial condition.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, and contract manufacturing organizations. We use certain vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including, for example, requiring our vendors to complete security questionnaires and conducting vulnerability scans related to our vendors' services.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and monitoring our cybersecurity programs and assets. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity risk management, strategies and processes remain at the forefront of industry best practices.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: implement appropriate changes. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Bandwidth Inc.

ticker: BAND


text: Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection ("Information Security"). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: The NCG Committee is briefed quarterly by management on, among other things, our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. The NCG Committee provides regular updates to the Board of Directors on such reports.

companyName: COHERENT CORP.

ticker: COHR


text: Discussion of Material Cybersecurity Risks and Incidents We have not experienced any material cybersecurity incidents in the past calendar year and the expenses we have incurred from cybersecurity incidents during that period were immaterial. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a full discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, SideChannel, Inc. engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: SideChannel, Inc.

ticker: SDCH


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Head of Computational & Structural Science, Chief Legal Officer and General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: As part of the cybersecurity program, we have adopted a cybersecurity incident response plan (the "Plan") designed to identify, evaluate, respond to, and resolve cybersecurity incidents impacting IT/OT systems. Pursuant to the terms of the Plan, we have established a CSIRT Steering Committee which includes, among others, the Chief Financial Officer, CAO, and the Enterprise Security Director. The CSIRT Steering Committee is responsible for overseeing and implementing the Plan in the event of a cybersecurity threat or incident and provides updates regarding the status of the response to senior management, including the CEO, who provide updates and reports regarding cybersecurity incidents to the AOC and/or the Board of Directors at regularly scheduled meetings or more frequently, as needed. WEC Energy Group, Inc.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: As discussed above, the InfoSec Leadership Team reports about cybersecurity threat risks, among other cybersecurity related matters, to senior management and the Audit Committee, which provides updates to the full Board of Directors.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer and Chief Technology Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Managing information technology ("IT") and cybersecurity risks, including maintaining confidentiality and privacy for our clients and employees, is critical to the successful operation of our business. We are aware that there are risks presented by cybersecurity, and are committed to preventing and mitigating such risks by following the below framework.

companyName: Evercore Inc.

ticker: EVR


text: On an annual basis, under the direction of the Company's Chief Risk Officer, the Company's Technology, Cybersecurity and Business Resiliency groups also participate in the enterprise-wide Own Risk and Solvency Assessment ("ORSA"), which outlines identified risks and describes the controls in place across the Company to address those risks. The ORSA is reviewed with the Company's lead regulator, the State of Connecticut Department of Insurance, which in turn performs periodic financial examinations, including a technology control assessment.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Roadmap and Risk Assessment We have a cybersecurity roadmap that provides a framework for prioritizing and managing our ongoing cybersecurity program. We conduct periodic risk assessments based on the National Institute of Standards and Technology ("NIST") cybersecurity framework to identify and assess our cybersecurity risks, vulnerabilities and information security maturity assessments to evaluate the maturity stage of the overall cybersecurity program. The results of these assessments are reported to the Audit Committee of the Board, and we adjust our cybersecurity roadmap, policies, processes and practices as necessary based on the information provided by these assessments as well as the monitoring, testing and auditing noted below.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed regularly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: We maintain a robust system of data protection and cybersecurity resources, technology and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements to keep our data secure. We monitor risks of sensitive information and reevaluate these risks on a frequent basis. We also perform annual and ongoing cybersecurity awareness training for our employees. We have a longstanding information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program deploys both commercially available solutions and proprietary systems to manage threats to our information technology environment actively and includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls, all of which are intended to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, us.

companyName: CIVITAS RESOURCES, INC.


text: Our Senior Vice President of Global Operations and our Director of Information Security are responsible for ongoing assessment and supervision of cybersecurity risks, supported by a dedicated Information Security team who reports up to those individuals. Our Director of Information Security has primary oversight of material risks from cybersecurity threats, has over 25 years of experience in cybersecurity-related roles and holds industry-recognized certifications. Our Senior Vice President of Global Operations and Director of Information Security review and evaluate our cybersecurity readiness through internal cybersecurity measures and metrics, as well as third-party penetration tests and control assessments against industry standards. We also employ various defensive and continuous monitoring techniques designed to escalate potential issues in a timely manner to our Director of Information Security.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Our cybersecurity function is overseen by our Senior Vice President/ Operations & IT Manager who has over 9 years' experience managing such functions. IT functions are also managed through our IT Committee which is comprised of several senior level executive officers and other Company employees and chaired by our Senior Vice President/ Operations & IT Manager. The IT Committee governs all IT functions at the Company and selects, monitors and manages our third-party IT service providers that implement and maintain our cybersecurity functions.

companyName: Bank7 Corp.

ticker: BSVN


text: Although unknown cybersecurity risks could materialize as a result of risk factors identified during the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents. Refer to "Item 1A. Risk Factors" of this Annual Report on Form 10-K for further discussion of cybersecurity risks.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: At this time, our cybersecurity risk management program is undergoing an effort to expand and mature our security controls and documentation. Our ongoing efforts include: • A security risk assessment conducted by an external supplier to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. This assessment is ongoing and will be completed in the third quarter of 2024. • The implementation of revised information security program documentation and policies in the first quarter of 2024, including: o revision and implementation of a revised information security policy; o implementation of a revised incident response plan and policy; o implementation of a third-party risk management program that includes update procedures for third party vendor due diligence; o implementation of additional periodic cybersecurity and awareness training for all of our employees.

companyName: scPharmaceuticals Inc.


text: Executive Officers of the Registrant Set forth below is certain information about our executive officers as of February 20, 2025.

companyName: Restaurant Brands International Inc.

ticker: QSR


text: The Audit Committee regularly reviews our cybersecurity and other technology risks, controls and procedures. The Audit Committee receives reports from the CIO quarterly regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. The Company's Information Technology Security Team and its cybersecurity infrastructure is overseen by the CIO who reports to the Chief Executive Officer. The CIO has served in various roles in information technology for over 29 years.

companyName: UNIFI INC

ticker: UFI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Security and Executive Director/Head of IT. Our Director of IT Security has over 13 years of experience leading IT security and has certifications including CISSP and CCSP. Our Executive Director IT Data Management, Analytics and Integration has over 20 years of experience in IT, data engineering, and data analytics.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector where our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Although we are not aware that we have experienced any material misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information as a result of a cybersecurity breach or other act, we are regularly the target of attempted threats such as ransomware and denial-of-service attacks. In addition, our customers, vendors and other third-parties also face the same threats, and a cybersecurity incident impacting any of these parties could also impact our operations. For these reasons, cybersecurity is critical to supporting our business and protecting our customers.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology ("NIST") and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: Conducting thorough due diligence concerning our third-party service providers, including evaluating their cybersecurity practices; and Providing regular cybersecurity training for both our employees and our Board of Directors.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: The Board oversees the Company's risk management process directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies and the steps management has taken to monitor and mitigate such exposures and risks.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: Corporate Governance Our Board has ultimate oversight of cybersecurity risk, which we manage as part of our ERM program. This program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board on its activities on a quarterly basis or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Annually, we offer cybersecurity training programs to our Board. The cybersecurity trainings are designed to provide Board-level insight into cybersecurity strategy, leadership, and management in addition to organizational best practices to prepare, protect and respond against new and emerging cyber security risks and breaches.

companyName: Playa Hotels & Resorts N.V.


text: Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management (ERM) program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer (CISO) responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.

companyName: KELLY SERVICES INC

ticker: KELYA


text: We assess and identify security risk to the organization by: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted; • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Company's Senior Vice President of Information Technology (SVP-IT); • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended, and producing the desired outcome; and • periodically scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Our incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO, Senior Vice President of Finance, CCO, Senior Vice President of People and Performance, and Director of Information Security. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The Audit Committee of our Board of Directors has oversight responsibility for the policies, processes and risks relating to cybersecurity. A senior member of our internal group attends all scheduled Audit Committee meetings and provides in-depth reports to the committee on cybersecurity risks and updates on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness. Moreover on a quarterly basis, a senior member of our internal control group reports to the Audit Committee and assists the committee with its review of relevant cybersecurity risks and evaluation and updating of our Cyber Risk Controls. Certain members of our Audit Committee have specific experience in information security and cybersecurity, and the Company has made cybersecurity training available to members of the Audit Committee.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Avalon faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the audit committee and board of directors on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company.

companyName: AVALON HOLDINGS CORP

ticker: AWX


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and cybersecurity incidents that could affect our information or systems. For more information, see Item 1A. Risk Factors.

companyName: ORAGENICS INC

ticker: OGEN


text: We utilize third party cybersecurity consultancy firms to manage and execute our cybersecurity programs. These third party firms are led and supervised by our Chief Technology Officer ("CTO"). Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. On a quarterly basis, our third party cybersecurity consultancy firms perform phish testing and on demand information security training. On a yearly basis, our third party consultancy firms perform, among other trainings and assessments, information security awareness training, internal cybersecurity risk assessments, internal and external penetration tests, key vendor risk assessments, incident response tabletop exercises, written information security and business continuity plan policy gap analysis reviews and revisions as well as incident response plan reviews and revisions. The results of the assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, auditing of our CISP or consulting on our response to cyber security threats and breaches. Results of these evaluations are used to help determine priorities and initiatives to improve the overall CISP. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through the established reporting lines of the CIO and CISO and through its oversight of the information security program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: GRESHAM WORLDWIDE, INC.


text: Supplier Risk Management and Strategy Within the governance, risk and compliance division of our Information Security team, we operate a formal supplier security assessment program, with a team dedicated to evaluating the cybersecurity risk associated with third party suppliers with whom we have contracted and who we believe may pose a cybersecurity threat to the Company, our customers or our business partners due to the type of services they provide and/or confidential information they may be handling. This team assesses the security posture of the supplier, as well as the security of the systems and services provided. In addition, the team works closely with our procurement and legal teams to help ensure that appropriate security requirements are included in our contractual arrangements with the suppliers. The team conducts an assessment both at the outset of the engagement of a new supplier, and then periodically thereafter, based on assigned risk levels, as well as in the event of any new services or changes to the engagement. The Information Security team's process for conducting periodic security reviews of third parties is a component of our operational risk management team's broader periodic review of third parties.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Prudential's information security program is overseen by its Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"), Stacey Goodman. Each of Prudential, the Manager, their affiliates and the Company believes that Prudential's employees and the employees of the Manager, Subadviser and their affiliates who provide services to the Company, respectively, responsible for managing cybersecurity risk have the skills and knowledge to assess and manage material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. Prudential expects these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. Prudential's CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. Prudential's CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. Ms. Goodman, our CIO, was elected Executive Vice President and Chief Information Officer of Prudential Financial and Prudential Insurance Company of America in July 2019. Previously, she served as the Chief Information Officer at Freddie Mac, where she was responsible for the technology division, and served as a member of the Senior Operating Committee. Prior to Freddie Mac, Ms. Goodman was Executive Vice President and Chief Information and Operations Officer for CIT Group, Inc., where she was a member of the Executive Management Committee. Previously, Ms. Goodman was the Divisional Chief Information Officer of Global Technology and Operations at Bank of America. She also held global leadership positions at UBS and PaineWebber. Ms. Goodman began her career at Salomon Brothers.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews our programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: QWEST CORP

ticker: CTBB


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. Our cybersecurity risk program is designed to identify, assess, prioritize and mitigate risks across the organization; and to ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's other operational, financial and strategic risk mitigation strategies.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: Our overarching approach to cybersecurity risk management centers on governance, people, processes, and technology. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. This includes mandatory annual cybersecurity training and monthly phishing simulations. We also perform periodic internal tabletops or simulation exercises involving technical experts, business and functional leaders, as well as separate exercises with select critical third-party service providers.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our cybersecurity risk management process is integrated with our overarching risk management system, led by our ERM team, and further guided by our Technology Risk Committee. Our Technology Risk Committee is responsible for reviewing and approving the effectiveness of our cybersecurity risk framework and assisting with the oversight of decisions that affect compliance with applicable legal and regulatory matters and corporate policies. As part of the management oversight structure, the ERM team provides our Management Risk Committee with periodic updates on key risk conditions, strategy and mitigation efforts.

companyName: HERBALIFE LTD.

ticker: HLF


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. However, despite our security measures, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors - Cyberattacks and other disruptions of our information technology network and systems could interrupt our operations, lead to loss of our customer and employee data and subject us to damages."

companyName: SANMINA CORP

ticker: SANM


text: In connection with our overall cybersecurity risk management processes, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors. Employees at the Company receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. We also engage a third-party service provider to provide monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a cybersecurity incident response plan ("CIRP") that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: Our CISO, who reports directly to our CIO, has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.

companyName: CORPAY, INC.

ticker: CPAY


text: To date, we have not encountered cybersecurity incidents that have materially impaired our operations or financial position. However, we are proactively preparing for the possibility of cybersecurity risks, ensuring that our systems are protected against potential threats in the future.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: The Company employes a defense in depth posture, designed to safeguard information, prevent unauthorized access, detect, and respond to threats, and maintain the confidentiality, integrity, and availability of data. The ISP establishes controls across many domains including but not limited to: Information Security Governance, Inventory and Control of Enterprise Assets and Software, Data Protection, Secure Configuration of Enterprise Assets and Software, Account and Access Control Management, Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, Application Software Security, Incident Response Management, and Penetration Testing.

companyName: Merchants Bancorp

ticker: MBIN


text: Oversight responsibility over cybersecurity risk is shared by the Board and the Audit Committee, with the Audit Committee being primarily responsible for overseeing risks related to cybersecurity, data protection, privacy, and significant emerging technology. The Audit Committee regularly reviews metrics about cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape, in addition to the results of third-party reviews and assessments of our security controls. Our CDIO or CISO provide regular cybersecurity updates in the form of written reports and presentations to the Audit Committee at its quarterly meetings, which are also provided to the full Board. We also have protocols by which certain cybersecurity incidents are escalated and, where appropriate, reported to the Audit Committee in a timely manner.

companyName: LOWES COMPANIES INC

ticker: LOW


text: • Network security: Firewalls, intrusion detection/prevention systems (IDS/IPS), and data loss prevention (DLP) solutions are deployed to monitor and filter network traffic. • Endpoint security: Antivirus, anti-malware, and Mobile Device Management solutions are implemented on all company devices. • Access controls: User access controls are implemented to restrict access to sensitive data and systems based on the principle of least privilege. • Data security: Encryption solutions are used to protect sensitive data both at rest and in transit. • Security awareness and training: We provide regular security awareness training to all employees to educate them on cybersecurity best practices and phishing attempts.

companyName: C3.ai, Inc.

ticker: AI


text: The Cybersecurity Steering Committee generally meets on a quarterly basis and receives reports from the CISO and CIO of our cybersecurity and information security risk management and strategies, covering topics such as data security posture, results from third-party assessments, progress towards key initiatives, our incident response plan, and cybersecurity threat risks, incidents and developments. The Cybersecurity Steering Committee generally delivers reports and updates to the Audit Committee once a quarter.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: In light of the pervasive and increasing threat from cyberattacks, the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cyberattacks. The Company's Information Technology ("IT") leadership team consults with and provides regular updates to the Board of Directors, as well as our chief executive officer and other members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of the information security program, timely reports regarding any cybersecurity incident that meets established reporting thresholds, and emerging threat landscape. In addition, the Company has an IT governance committee, which is comprised of the chief executive officer, IT and other officers of the Company. The IT governance committee meets quarterly, and as necessary, to discuss the cybersecurity program and other relevant topics. The IT team also consults regularly with the Board of Director's cybersecurity expert in between meetings. Our program is evaluated by internal and external experts with the results of those reviews reported to senior management and the Board of Directors, at least semi-annually. The Board of Directors has oversight responsibility for our data security practices and we believe the Board of Directors has the requisite skills and awareness into the design and operation of our data security practices to fulfill this responsibility effectively.

companyName: Metallus Inc.

ticker: MTUS


text: The Company's cybersecurity risk management program includes ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes various incident event management tools to monitor unauthorized account access, data exfilitration and server and network security. Multi-factor authentication and complex password requirements are enabled on all key systems and privileged account holders have separate administrative accounts. The Company engages consultants from time to time with expertise in network vulnerabilities to perform periodic network penetration testing.

companyName: CUMULUS MEDIA INC

ticker: CMLS


text: We engage assessors, consultants, outside counsel, and other third parties in connection with our cybersecurity-related risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. For example, we engage independent entities to conduct platform, infrastructure, and hardware-level penetration tests on at least an annual basis.

companyName: Samsara Inc.

ticker: IOT


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including, among other things, intellectual property, trade secrets, confidential information that is proprietary, strategic or competitive in nature, and personal data (collectively, Information Systems and Data).

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: The Company maintains a comprehensive approach to cybersecurity and data protection, based on a risk-based, defense-in-depth strategy. We regularly assess industry best practices and standards and endeavor to implement them in our efforts to manage cybersecurity risk. We follow industry standard cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework, to design, assess and update our cybersecurity strategy, controls and processes. Our focus is on protecting our highest-value information assets, which include manufacturing systems, financial systems, and confidential, personal, and private information.

companyName: WESTLAKE CORP

ticker: WLK


text: Our cybersecurity risk management program includes enterprise-wise monitoring of cyber activity to identify and analyze potential events that may have an adverse effect or impact on the Company's assets, systems, resources or reputation. This monitoring is designed to identify both external activity and routine internal activity for behavior that may be unusual or potentially malicious. Depending upon the nature and severity of the risk, cybersecurity monitoring and identification can result in automated processes to immediately block and remove undesired risks, cybersecurity team review and action, or both. The Cybersecurity Incident Response Plan provides a framework for addressing a cyber-crisis, cyber-incident and/or data breach, which could include activating crisis, or business continuity recovery plans, as appropriate. These plans are regularly reviewed and updated by our Chief Information Officer and communicated to appropriate stakeholders.

companyName: Cornerstone Building Brands, Inc.


text: Our Board of Directors has delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks to the Audit Committee. Our Vice President of IT, under the supervision of our Chief Financial Officer, is responsible for the establishment and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The Vice President of IT will regularly consult with outside security experts and management to evaluate certain aspects of the cybersecurity risk management program. The Vice President of IT has approximately 15 years of experience in information security and cybersecurity risk management. The IT team also institutes and maintains controls for our systems, applications, and databases.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: The CTO, who serves as the Chief Information Security Officer ("CISO") for the Company, is the primary executive responsible for leading the Company's cybersecurity risk management program and has over 30 years of experience in various technology-related roles, including responsibilities related to managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Company's Computer Security Incident Response Team ("CSIRT") has primary responsibility for monitoring and enacting the incident response program and is led by the Senior Director of Information Security who reports to the CTO.

companyName: VALVOLINE INC

ticker: VVV


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring services, forensic investigators and endpoint detection and response vendors.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Oversight of cybersecurity infrastructure is managed by members of our management team, including our Chief Executive Officer and Chief Data Officer. Management works in tandem with a third-party service provider (the "Service Provider"). The Service Provider routinely reviews and updates our antivirus and antimalware software, monitors our intrusion detection system and intrusion protection system and reviews and cleans our corporate email system. Other than engaging the Service Provider prior to our initial public offering, given our overall risk profile, the Board has had limited involvement with our cybersecurity risk management. The management team, with support from the Service Provider, would raise any significant cybersecurity risks with the Board.

companyName: Edible Garden AG Inc

ticker: EDBL


text: Our corporate controller reviews the efficacy of our cybersecurity procedures from time to time as circumstances make it appropriate and annually in connection with the annual audit of our financial statements. Our corporate controller reports to our CEO and CFO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management procedures. Our CEO and CFO provide prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding our cybersecurity activities.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Our business strategy, results of operations, or financial condition may be materially affected if our IT resources are compromised, whether by an intentional attack, natural or man-made disaster, electricity blackout, IT/cybersecurity failure, systems misconfiguration, denial-of-service attacks, service provider error, mismanaged user access protocols, personnel action, or otherwise, as we may be severely limited in conducting operations for an extended period, experience internal control failures, be cut off from assets or funds, face reputational damage, lose customers and related revenues and/or have private party or governmental legal proceedings instituted against us, and incur significant expenses to resolve any such issues. Similar impacts may result from a substantial disruption, or security incident or breach KBHS or an outside service provider to our customers suffers, which could also result in sensitive personal information being publicly disclosed or misused.

companyName: KB HOME

ticker: KBH


text: PSCo is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: PUBLIC SERVICE CO OF COLORADO


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from the finance department or external information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: While neither the Sponsor no r the Trust has experienced a material cybersecurity incident, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition. For further discussion of the risks the Trust faces from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Trust Investment—Investing in the Trust may result in the total loss of investment due to passive management strategies, cybersecurity vulnerabilities, and inadequate recovery options for lost assets."

companyName: Bitwise 10 Crypto Index ETF

ticker: BITW


text: We rely upon both internal and external resources for evaluating and enhancing our cyber posture. Our information security team works with external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. We require annual cybersecurity training by our employees, send out regular tips and memos to help our employees recognize phishing emails and other social engineering tactics, and provide various methods for employees to report suspicious activity that may give rise to a cyber-incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: The management of the Company is responsible for overseeing risk for the Company and has delegated to the VP, Engineering & Technology ("VPE&T") the responsibility for overseeing the cybersecurity risk management strategy for the Company. Management receives regular updates on our cybersecurity risk management process from the VPE&T. The VPE&T reviews our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol that provides for the notification, escalation and communication of significant cybersecurity events to the management team.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CISO has over 35 years of experience in various roles in information technology and information security, including serving as SVP and CIO or VP and CIO at various defense, aerospace and semiconductor supplier companies. He holds a bachelor's degree in Computer Science, an MBA, and holds several relevant certifications, including ITIL Certification. The corporate information security organization manages and regularly enhances our enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our cybersecurity incident response team ("CIRT"), which is responsible for the protection, detection and response capabilities used in the defense of Cohu's data and enterprise computing networks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, mitigation or eradication, recovery and notification, including notifying key functional areas, as well as the CEO, Chairperson and Chairperson of the Audit Committee and other members of the Board, as appropriate.

companyName: COHU INC

ticker: COHU


text: Our cybersecurity program is focused on the following areas: • Governance: We leverage multiple cybersecurity frameworks (e.g., ISO 27001 and NIST CSF) and regulatory requirements to form our Information Security Management System (ISMS), which is defined through policies and standards. Policies are applicable to all employees globally. These policies are reviewed periodically to ensure they remain relevant. For additional information regarding governance of our cybersecurity program, see the sections below entitled "Board Oversight of Cybersecurity Risks" and "Management's Role in Assessing and Managing Cybersecurity Risks." • Technical Safeguards: We deploy technical and procedural measures to protect our technology and data. Protection measures include network firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments and remediation processes, threat intelligence, anti-malware and access controls, plus data loss prevention and monitoring. • Security Awareness / Training: All employees are required to adhere to our Standards of Business Conduct, which identifies an employee's responsibility for information security. We provide annual cybersecurity training for all employees, as well as enhanced role-specific information security training for certain employees. In addition to this training, security awareness articles are disseminated periodically throughout the year. We also sponsor a "Cyber Security Awareness Month" in October each year and conduct regular phishing detection and response exercises. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber-incident and routinely evaluate the effectiveness of such plans. Incident response plans focus on cyber risk issues, including detection, response and recovery; cyber threats, with a focus on external communication and legal compliance; and breach simulations and penetration testing through internal and external exercises. Each year, we engage a third-party expert to oversee a cybersecurity incident response exercise to test pre-planned response actions from our incident response plan and to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics. • Third-Party Suppliers and Service Providers: We conduct periodic vendor security reviews and risk assessments for prospective and current third-party technical suppliers and service providers. Vendor security reviews evaluate numerous key security controls and the outputs of these reviews are used as part of business decisions regarding procurement and to assess a vendor's overall security posture relative to a defined set of security criteria. • Certifications: Our security program is audited on an annual basis by several independent groups including an accredited certification body, leading accounting firms and institutional clients. • Experts: We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. Our collaboration with these third-parties includes periodic audits, threat assessments and consultation on security enhancements.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Our management team, including our CISO and Director of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The information technology team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the I.T. environment.

companyName: System1, Inc.

ticker: SST