text: We have an IRP that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for investigations designed to help us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident. Governance.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: We engage assessors, consultants, auditors, and other third parties in connection with the above processes. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to specific security standards and protocols.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI

secItem: Item 1C


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company or the Operating Partnership, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this Annual Report, including the risk factor entitled "Cyber-attacks or acts of cyber-terrorism could disrupt our or our third-party providers' business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information", for additional discussion about cybersecurity-related risks.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: To oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we have implemented a third-party risk management program designed to help protect against information misuse and assess the information technology security measures of potential third parties and business partners. We perform a third-party risk assessment before starting a relationship with certain service providers and utilize a third-party risk intelligence program to monitor the activity of critical vendors following engagement. In addition, we maintain cyber insurance coverage as part of our overall risk mitigation strategy. This cyber insurance coverage may not be sufficient to cover against all claims.

companyName: Sage Therapeutics, Inc.


text: The Williams' Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, the CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward TSA compliance. Additionally, the CIO and/or CISO presents to the Board bi-annually regarding our cybersecurity risks and strategies, including as part of our annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, the CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, we have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: Monitoring and Responding to Cybersecurity Incidents and Data Breaches Management reduces the risk of cyber incidents by monitoring network traffic through security controls, including firewalls, intrusion detection/prevention systems, anti-virus/anti-malware systems, cyber threat intelligence, and vulnerability monitoring tools. We use extended detection and response (XDR) technology to integrate network, endpoint, and cloud data to stop sophisticated attacks by detecting malware and exploit threats, including using artificial intelligence (AI) behavioral analytics. We also partner with a security operation center (SOC) to provide 24-7 outside monitoring services for additional support to the internal IT team.

companyName: BOISE CASCADE Co

ticker: BCC


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: Rubber Leaf Inc

ticker: RLEA


text: Our CCO provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our CCO provides annual briefings to the board of directors on cybersecurity risks and activities.

companyName: HARMONIC INC.

ticker: HLIT


text: Once the Department Manager has determined that unauthorized access, manipulation of data or theft of any item identified under GLBA Inventory and Asset Classification has occurred, Senior Management, the Compliance Officer and the Information Technology Administrator must be contacted immediately.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: The corporate information security organization has implemented a governance structure and process to assess, identify, manage and report cybersecurity risks. We also have a corporate-wide counterintelligence and insider threat detection program to proactively identify external and internal threats, and mitigate those threats in a timely manner. In addition to developing and implementing pre-existing third party frameworks, we have implemented our own practices and customized controls tailored to the Patrick enterprise environment. We believe this approach enhances our defense in depth stance while increasing our ability to identify, contain and manage cybersecurity risks.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose sensitive personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notification and other procedures according to applicable law.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: As detailed in the risks related to the use of technology, third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.

companyName: WESBANCO INC

ticker: WSBC


text: Cybersecurity Risks Management and the Board of Directors acknowledge that technology systems, managed both by the Company and third-party service providers, are critical to business operations and therefore require appropriate risk management.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is maintained for record by Customer's Enterprise Risk Management team. Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as the Customers' Directors' Risk Committee and Board of Directors deems appropriate.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: In addition, the Registrants' cybersecurity team regularly coordinates with industry peers, the Edison Electric Institute, and state and federal agencies to improve threat intelligence, situational awareness, and security practices.

companyName: OGE ENERGY CORP.

ticker: OGE


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber-attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled "We are subject to certain risks in connection with our use of technology."

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: Board's Oversight of Cybersecurity Risks Our Board of Directors is focused on cybersecurity. Specific responsibility for cybersecurity oversight is delegated to the Audit Committee. The Board oversees our risk management process to ensure it is properly designed, well-functioning and consistent with our overall corporate strategy. Our Audit Committee oversees the ERM process and the implementation of appropriate risk monitoring and management systems, though all Board members attend Audit Committee meetings and participate in risk management discussions.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Cybersecurity oversight is an integral component of the Company's enterprise risk-management (ERM) process. Identified threats and mitigation plans are reviewed alongside financial and operational risks. The Chief Compliance Officer (CCO) and Chief Technology Officer (CTO) jointly oversee cybersecurity posture and report quarterly to the Board of Directors. Cybersecurity objectives align with corporate governance and business-continuity strategies.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and established policies and processes for assessing, identifying, and managing material cybersecurity risks based upon cybersecurity threats, vulnerabilities, likelihood, and impact, and have integrated these processes into our overall risk management systems and processes, which are overseen by our Chief Operating Officer and Chief Financial Officer. We routinely assess cybersecurity risks that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Axonics, Inc.


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, and (v) ongoing security awareness training programs for all employees.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Together with a third-party, we operate a 24/7 Security Operations Center ("SOC") to monitor the cybersecurity environment and coordinate escalation and remediation of alerts. Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan. This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation. IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required. The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the Senior Director, Security & Infrastructure, and the VP & Controller. The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.

companyName: Murphy USA Inc.

ticker: MUSA


text: The Audit Committee is responsible for overseeing the Company's enterprise risk management program, including cybersecurity risks. At its quarterly committee meetings, the Audit Committee reviews and discusses cybersecurity matters directly with our CISO, including relevant cybersecurity risks, changes to AutoZone's threat landscape, risk mitigation strategies, cybersecurity program assessments and results, and cybersecurity roadmap and progress.

companyName: AUTOZONE INC

ticker: AZO


text: The Company maintains a Privacy Policy that describes the personal information that it collects about its customers, including how the Company may use such information and when it shares such information with third parties.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: As a leading global diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to conduct critical operations and generally operate our business, which includes using information technology systems to process, transmit and store electronic information, including customer, employee and company data. The use of information technology systems makes us vulnerable to breaches of data security and cybersecurity attacks. For information on the potential risks related to cybersecurity, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: As part of our risk management process, we conduct regular application security assessments to identify vulnerabilities within our IT infrastructure. These assessments include both automated scans and manual reviews by our cybersecurity team. Threat intelligence feeds and security reports are continuously monitored, with the goal of staying ahead of emerging threats. In the event of a cybersecurity incident, we maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually along with random internal phishing campaigns.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: c. The use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; d. An incident response plan with procedures for responding to cybersecurity incidents;

companyName: Douglas Emmett Inc

ticker: DEI


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks, systems and data. Such processes include physical, procedural, and technical safeguards, employee training and incident simulations. We have the capacity to engage certain external parties, such as consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We also consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Information Security Officer ("ISO") reports directly to the Chief Risk Officer ("CRO") and provides direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities. The ISO has more than 20 years of information security experience at financial institutions as well as information security consulting firms, and maintains various cybersecurity and IT audit professional certifications. The ISO works in partnership with the Company's Information Technology department and is supported by both internal and external information technology and information security tools, resources and staff.

companyName: First Financial Northwest, Inc.


text: The IT Manager has the primary responsibility for managing the Program to identify, assess, manage and control cybersecurity risk. The IT Manager reports directly to our Chief Operations Officer. Our IT Manager has approximately 20 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Our management team, including our Senior Vice President of Security Operations and the Security Operations team, is responsible for assessing and managing our material risks from cybersecurity threats. The Security Operations team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and contractors. Our Security Operations team includes members with a variety and depth of experience in cybersecurity matters, with more than 80 years of combined cybersecurity experience amongst the team members and the Senior Vice President of Security Operations with more than 30 years of information technology and cybersecurity experience throughout his career. The Senior Vice President of Security Operations holds Certified Information Systems Security Professional and Certified Identity and Access Manager certifications, while the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.

companyName: EverCommerce Inc.

ticker: EVCM


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity events in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors. Governance.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: We have a detailed incident response plan in place in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company's cybersecurity incident response strategies and tactics. We use a third-party Security Operations Center to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents, and our CISO and CTO actively engage with key vendors, industry participants, the U.S. Department of Homeland Security, and intelligence and law enforcement communities. The company also maintains a vendor relationship with a cyber security firm that supports the Bank to review and mitigate any potential cyber incidents. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.

companyName: CROSSFIRST BANKSHARES, INC.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. Our executive management team inform the Audit Committee on cybersecurity risks on a regular basis, with a minimum frequency of once per year.

companyName: Ainos, Inc.

ticker: AIMD


text: Structured Data Requirement Consistent with SEC regulations, OPKO Health, Inc. commits to providing the information required by this Item in an Interactive Data File format, in accordance with Rule 405 of Regulation S–T and the EDGAR Filer Manual.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We engage third parties annually to evaluate our information security posture, risks and third-party service provider solutions as part of our overall risk management activities. We maintain an inventory of vendors and third-party service providers and evaluate those service providers for cybersecurity risks annually at a minimum.

companyName: Urgent.ly Inc.

ticker: ULY


text: Board of Directors and Audit Committee Oversight Our board of directors (the "Board") understands the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: CTO's President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary work collaboratively with the MSP to implement a program designed to protect CTO's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with written information security incident response plans adopted by CTO and the Company. These members of CTO's management team, together with the MSP, will monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: The Company, through its information technology partner, has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Longeveron Inc.

ticker: LGVN


text: Maintaining the integrity and availability of our IT systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to our operations and business strategy. To this end, we have implemented an Information Security Management System (ISMS) within which cybersecurity and risk management strategies are an integral part. The ISMS Committee, which is comprised of companywide and IT department senior management, creates and manages the processes, policies, and procedures for managing the overall security of the organization. The ISMS includes a risk management program designed to assess, identify, track, treat, manage and prevent strategic and operational risks that may impact our company's business model or operations with a focus on information security, including but not limited to cybersecurity risk, physical security risk, liability risk, innovative risk, competitive risk, and other potential unauthorized occurrences on or through our IT systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The Risk Subcommittee, a subcommittee of the ISMS Committee, comprised of IT and Information Security senior leadership, maintains a risk register of cybersecurity risks that are regularly monitored and meets once a month to discuss remediation plans and treatment progress for existing risks. New potential risks are submitted to the Risk Subcommittee as they are identified by personnel from across the Company, including executive leadership, managers, directors, analysts, and others. In compliance with our Risk Management Standard and Process policy, new potential risks are evaluated by the Risk Subcommittee to determine whether each risk is to be added to the risk register and analyzed for treatment. The Risk Subcommittee invites subject matter experts from across the Company to participate in remediation planning and treatment progress reporting sessions as part of the monthly Risk Subcommittee meetings. Members of the ISMS committee and the Risk Subcommittee report directly to the Chief Executive Officer who, in turn, reports to our Board. Our ISMS is informed by internationally recognized standards and is vetted and validated annually by external advisors or consultants.

companyName: KLDiscovery Inc.


text: The GIS team leverages several mechanisms to continuously identify and assess cybersecurity risks across the Company and utilizes a GRC platform to monitor identified risks and mitigation and remediation activities. The GIS team uses defined industry accepted risk management and controls frameworks to determine the potential likelihood and impact of each risk. Monitoring activities are designed and executed based on the materiality of the assessed likelihood and magnitude of impact of the risks that are identified. The GIS team, with the assistance of third-party consultants, performs application security reviews, penetration tests and gap assessments against certain cybersecurity frameworks. Management reviews any assessments performed by the third-party consultants and determines the final evaluations and communication plan, which the GIS team executes.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") initiative safeguards sensitive information within the Defense Industrial Base by ensuring members meet cybersecurity requirements for handling controlled unclassified information and federal contract information. The CMMC initiative helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe.

companyName: Astra Space, Inc.


text: Our Director of IT is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the Senior Vice President of Managed Services. He has over 20 years of cybersecurity experience.

companyName: DecisionPoint Systems, Inc.


text: Our Vice President ("VP") of Security and Controls, who has over 16 years of experience in information technology and security and who holds Certified Information Systems Security Professional and IT Infrastructure Library certifications, has primary responsibility for overseeing our management of cybersecurity risks. Reporting to the Chief Technology Officer ("CTO"), our VP of Security and Controls meets regularly with the CTO, and works cross-functionally with other department leaders, including legal, business, policy, and technical functions, as appropriate, to exchange information related to cybersecurity. Our VP of Security and Controls provides quarterly updates to our Audit Committee on our cybersecurity status, risks, and strategies. These quarterly updates address a range of cybersecurity-related topics, such as recent developments related to the threat landscape, security controls, vulnerability assessments, third-party reviews, technological trends, and information security considerations arising with respect to our peers and third parties.

companyName: Symbotic Inc.

ticker: SYM


text: No Material Incidents. As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. Since inception in January 2018, we are not aware of any cybersecurity or information security incidents that have materially affected us to date. We have not incurred any expenses due to material information security incident penalties or settlements. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. Refer to the risk factor "We are highly dependent on information systems and third-parties, and system failures or cybersecurity incidents incurred by us or the third-parties that we rely on could significantly disrupt our ability to operate our business." in the section entitled "Risk Factors—Risks Related to Our Company and Our Structure" for more information regarding our cybersecurity risks.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Proactive Risk Mitigation & Vulnerability Management We take a proactive approach to cybersecurity, evaluating the latest industry threats against our organization to ensure protection. This evaluation directly informs our security enhancements. For example, identified vulnerabilities or threat vectors prompt updates to firewalls, intrusion detection systems, email filtering and security training etc. We also perform real-time analyses, automate responses to suspicious activity, and maintain robust alerts. The results of these scans, along with threat intelligence, are used to prioritize vulnerability remediations and enhance long-term cyber security hardening efforts.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Cyber Oversight Group, led by our CDTO and VP, Information Security and Compliance. Our CDTO has decades of experience as Chief Technology Officer with multiple companies, and significant expertise in enterprise architecture, engineering, analytics and digital technology. In addition, our VP, Information Security and Compliance has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CDTO and VP, Information Security and Compliance are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments to help identify material risks from cybersecurity threats to our critical systems and information; • a security team that includes internal IT and data privacy personnel and external managed services partners, principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including: • annual external and internal penetration tests; •24-hour monitoring of our networks and cloud resources to help detect, respond to and recover from cyber-attacks;

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by a contracted third-party Information Security Officer. Such individual has over 25 years of experience in information technology, including over 14 years of experience in cybersecurity, and has a master's degree in cybersecurity. Our Information Security Officer is informed about and monitors our cybersecurity risk through his participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: TAO Synergies Inc.

ticker: TAOX


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of our cybersecurity program to the Audit Committee. In connection with that oversight responsibility, senior members of our information security team meet with the Audit Committee on a regular basis (but no less than semi-annually) and provide information and updates on our cybersecurity program and related topics. This includes existing and new cybersecurity risks, status on how management is identifying, assessing, managing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, and developments in the cybersecurity space and evolving standards.

companyName: Sonos Inc

ticker: SONO


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 19 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board of Directors and the executive team, these management team members will notify the executive team and the Board of Directors and draft the required disclosure.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Risk management and strategy Managing Material Risks & Integrated Overall Risk Management We have developed and continue to develop processes, including those intended to follow an internal Information Technology (IT) Security Policy, which seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. We also maintain an evolving cybersecurity roadmap for our future cybersecurity plans. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. In furtherance of our cybersecurity policies and procedures, our IT team has a monthly IT Steering committee meeting, chaired by our Chief Financial Officer ("CFO") and Chief Strategy Officer, where all new IT projects include a cybersecurity component.

companyName: electroCore, Inc.

ticker: ECOR


text: Board of Directors recognizes the critical importance of maintaining the trust and confidence of our tenants, business partners, investors, and employees. Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Plymouth Industrial REIT, Inc.


text: We perform simulations, tabletop exercises and response readiness tests on an annual basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides guidance to address the overall coordination of our response to a cyber crisis and plan for resources, actions and decisions we may need to be prepared for; a cyber crisis communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis, including the timeline, approval process and monitoring of messaging; and business continuity plans that document the application of specific strategies and measures to enable core business activities to continue during a cyber event. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly. Tabletop testing of the various plans occur annually with quarterly preparedness exercises.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: The Company provides regular, mandatory training for personnel on cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. The training includes phishing and smishing exercises.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. Our most sensitive data is stored in offline air-gapped devices. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: Our full Board of Directors provides ultimate oversight for the cybersecurity program, in addition to other significant risks of Intuit. The Board of Directors has delegated primary oversight of cybersecurity risks to the Audit and Risk Committee. On a quarterly basis, the CISO and CyberCRAFT specialists provide the Audit and Risk Committee with updates, metrics, and trends, such as the status of prior security events, existing and emerging threat landscapes, the results of audits or assessments, fraud prevention efforts, vulnerability detection and disclosure changes, and the status of projects to strengthen our security systems and improve incident readiness, and how these may affect broader enterprise risk management. Under our incident response processes' risk-based escalation protocols, the CISO, or other management, escalates certain incidents to the chair of the Audit and Risk Committee, who may then involve the broader committee or the full Board of Directors, as appropriate.

companyName: INTUIT INC.

ticker: INTU


text: On a periodic basis, our Board of Directors reviews the adequacy of our computer systems controls, cybersecurity risk management and related governance and incident disclosures.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: As an externally managed company, BREIT's day-to-day operations are managed by the Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior Blackstone Real Estate professionals and our Adviser is a subsidiary of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: The Company's Director of IT Operations works collaboratively with the Chief Executive Officer (CEO), Chief Financial Officer, (CFO) and Chief Legal Officer (CLO) to implement a thorough program to assess cybersecurity risks and vulnerabilities, protect the Company's information systems from cybersecurity threats, and respond effectively to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through this program, the Company monitors the prevention, detection, mitigation and remediation of cybersecurity threats in real time, reporting to the Audit Committee when appropriate.

companyName: Telesis Bio Inc.


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, together with external consultants it engages, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management.

companyName: Greenland Technologies Holding Corp.

ticker: GTEC


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: We have developed a Cybersecurity Council that reports directly to our Chief Strategy Officer & Chief Commercial Officer. The Cybersecurity Council is led by the Vice President, Information Technology, and is comprised of select members of the IT team with an average of nearly 20 years of cybersecurity experience. The Cybersecurity Council meets monthly to review current cybersecurity threats as well as our potential exposure. The Cybersecurity Council also engages periodically with external and internal auditors, as well as the Cybersecurity and Infrastructure Security Agency, the American Exploration and Production Council and the Federal Bureau of Investigation to stay informed on cybersecurity risk management.

companyName: Chord Energy Corp

ticker: CHRD


text: In the event of a cybersecurity incident, senior management, including our General Counsel, CIO, and Chief Financial Officer ("CFO"), are tasked with conducting an assessment of the incident. This assessment involves evaluating relevant quantitative and qualitative factors as well as considering SEC guidance. Depending on the assessment results, the cybersecurity event may be escalated to involve our CEO, Board of Directors, and law enforcement. Additionally, the Board of Directors in consultation with senior management will decide, based on the assessment, whether the cybersecurity incident requires disclosure in a filing with the SEC.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: This risk management approach informs decision-making processes related to the company's strategic priorities, the allocation of resources, and the establishment of oversight mechanisms. Our Board considers cybersecurity risk as part of its risk oversight function, and the governance of this program resides with our Board, which bears the ultimate responsibility for the oversight of cybersecurity risks. Supporting the Board, the Audit Committee plays a pivotal role by engaging in regular reviews of our cybersecurity efforts in collaboration with management and providing periodic updates to the Board. These assessments are conducted regularly, with additional sessions convened as needed to address emerging issues or refine strategies. In addition, management updates the Board, as necessary, regarding any significant cybersecurity incidents.

companyName: DZS INC.


text: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third-party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Further, our cybersecurity team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, risk assessment network security controls, detection and response tools and a vulnerability management program.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: The HSE & Technical Committee and/or the full Board receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Board.

companyName: UR-ENERGY INC

ticker: URG


text: Our information security function, which is led by our Chief Information Officer ("CIO"), helps identify, assess and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating certain threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments.

companyName: Immunocore Holdings plc

ticker: IMCR


text: We have implemented a cross - functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events.

companyName: SEELOS THERAPEUTICS, INC.


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented prior to a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access and integrity monitoring and reporting and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, IT and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging our people, external resources, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents. We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis. Additionally, we have a retainer for external forensics support if required for a material incident.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: As part of these developments, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third-party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit and Compliance Committee. The Audit and Compliance Committee oversees the development, implementation, and effectiveness of our strategies to monitor, mitigate, and respond to cybersecurity risks, as well as our procedures, policies and resources for risk assessment and risk management. In this role, the Audit and Compliance Committee receives updates from management on these matters, including the results of risk assessments and audits and the progress of risk reduction initiatives, on a quarterly basis or more frequently as needed. In addition, management updates the Audit and Compliance Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: Premier, Inc.


text: We have implemented an information security program to assess, identify, and manage material risks from cybersecurity threats. This program includes policies and procedures that guide the development, implementation, and maintenance of security measures and controls. We utilize industry-standard metrics to evaluate the criticality of software, data assets, and operational technology. We believe that our cybersecurity efforts align with the Center for Internet Security (CIS) Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we conduct annual assessments to ensure compliance.

companyName: STAR GROUP, L.P.

ticker: SGU


text: The Council meets monthly and updates key members of the Company's Executive Council on progress towards specific cybersecurity objectives. A strong partnership exists between Information Technology, Enterprise Security, Corporate Audit, and Legal so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: BOEING CO

ticker: BA


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect SOPA, including our business strategy, results of operations, or financial condition. Refer to "Part I, Items 1A – Risk Factor Relating to SOPA's business – Our business and operations would suffer in the event of third-party computer system failures, cyber-attacks on third-party systems or deficiency in our cyber security" in this Form 10-K for additional discussion about cybersecurity-related risks.

companyName: SOCIETY PASS INCORPORATED.

ticker: SOPA


text: Material Cybersecurity Risks, Threats & Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat. As a global company, we routinely experience the threat of a wide variety of cybersecurity incidents. In the last three (3) fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from non-material cybersecurity incidents were minimal. However, despite our significant cybersecurity protocols and governance, we cannot assure that we will not experience any such event in the future. Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See Item 1A. Risk Factors for further details on risks related to potential breaches of our information technology systems.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Our CIO is primarily responsible to assess and manage our material risks from cybersecurity threats. Our CIO has over 25 years of professional IT experience and has held numerous positions with responsibility for managing network and data security, including in the legal and banking industries.

companyName: GrowGeneration Corp.

ticker: GRWG


text: change logs are kept and updated on all of our key software; (iv) all major changes to hardware and infrastructure devices are performed and approved prior to production migration; (v) remote access is fully encrypted for all users; and (vi) internal firewalls are used to limit access to sensitive systems and applications; and • Maintain controls and processes relating to payments we make to third parties by using a combination of internal controls around the setup, maintenance and archiving of records to reduce fraud and erroneous payments.

companyName: FIRST INDUSTRIAL LP


text: Risk Management and Strategy Enterprise Risk Management and Technology Risk Management. Within the Company's Enterprise Risk Management program, Technology Risk Management plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the assessment of information and cybersecurity risks. Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements. In instances where a risk is identified as inadequately controlled, prompt remediation measures are implemented to reduce the risk to an acceptable level.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: To test our cybersecurity program, we perform periodic vulnerability testing, engage an independent third party to perform periodic internal and external penetration testing, and engage other third parties to conduct periodic assessments of our cybersecurity capabilities. We continuously expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing simulation campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.

companyName: Torrid Holdings Inc.

ticker: CURV


text: We maintain a comprehensive cybersecurity risk program to effectively identify, assess, manage, and respond to cybersecurity risks and incidents. Our program is implemented by in-house personnel with experience in cybersecurity fields and is further enhanced by external partners that specialize in cybersecurity services. Our program is built on recognized industry standards and frameworks that are regularly evaluated and updated to address emerging threats.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: Our CISO reports quarterly and more regularly, as needed, to our executive leadership team composed of our Chief Executive Officer, Chief Financial Officer, and Chief Information Officer on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology leaders also meet regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics. We have also developed a cross functional disclosure working group to assess elevated cybersecurity incidents and, as appropriate, report on such events to Avantor's standing Disclosure Committee to conclude on the materiality of the incident and any need for regulatory reporting.

companyName: Avantor, Inc.

ticker: AVTR


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Information Security and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: FIRST OF LONG ISLAND CORP


text: Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see "Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business," which is incorporated by reference into this Item 1C.

companyName: Vericel Corp

ticker: VCEL


text: Role of Management and Board Oversight Our cybersecurity team is comprised of individuals with experience in cybersecurity who hold cybersecurity-specific credentials and certifications. The team members belong to relevant professional organizations and receive continuing education and certification to stay abreast of emerging trends and cybersecurity best practices.

companyName: Silk Road Medical Inc


text: Although we believe we have adequate resources and sufficient policies, procedures, and oversight in place to identify and manage IT security risks related to our business operations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K under "Risks Related to the Operation and Growth of Our Business."

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams. Although we make efforts to maintain the security and integrity of our information technology systems, these systems and the proprietary, confidential, and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. For a discussion of these risks, see "Item 1A–Risk Factors– Cyber risk and the failure to maintain the integrity of internal or guest data could harm our reputation and result in a loss of business and/or subject us to costs, fines, investigations, enforcement actions or lawsuits."

companyName: Playa Hotels & Resorts N.V.


text: We also have an incident response plan that provides procedures for how we can detect, respond to, and recover from potential cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate any incident, as well as to comply with any applicable legal obligations and mitigate potential brand and reputational damage.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: individuals, including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;

companyName: BioCorRx Inc.

ticker: BICX


text: We have developed, implemented, and maintain certain cybersecurity processes and controls intended to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, based on material risks identified.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: Risk Management & Strategy As previously discussed under the section titled "Enterprise Risk Management", through our ERM program we have a risk management framework that recognizes the risks inherent in our operating segments as well as the risks associated with the operations of our holding company. This process includes assessing, identifying and managing material risks related to cybersecurity.

companyName: PROASSURANCE CORP

ticker: PRA


text: Our business necessitates the collection and storage of consumers' PII. As such, cybersecurity and data privacy are a top concern for us. As a preventative measure, we have implemented certain policies and procedures that guide our day-to-day operations in these areas.

companyName: Open Lending Corp

ticker: LPRO


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: LENSAR, Inc.

ticker: LNSR


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF 2.0 as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Our Chief Information Security Officer ("CISO") with help from our legal department and our security and compliance team from our IT infrastructure department help identify, assess and manage the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, conducting scans of the threat environment, conducting internal and external threat and vulnerability assessments, conducting internal and external audits, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting third party assessments and evaluating threats reported to us.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our cybersecurity risk management program includes physical, technological, and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity, and availability of our key information systems and customer, employee, partner, and other third-party information stored on those systems. These measures include access controls, encryption, data handling requirements, and internal policies that govern our cybersecurity risk management and data protection practices. Our program also includes cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems and information.

companyName: Zeo Energy Corp.

ticker: ZEO


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Rithm Capital Corp.

ticker: RITM


text: In accordance with our cybersecurity incident response plan, the severity of cybersecurity incidents is classified based on the degree of adverse impact on our business, scale of penetration, risk of propagation, significance of impact, impact on protected information, and our monitoring capability. Incident response is overseen by a cybersecurity incident response team steering committee comprised of members of management with the responsibility to inform senior management and/or the Audit Committee based on incident severity classification.

companyName: California Resources Corp

ticker: CRC


text: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities and conducting tabletop incident response exercises.

companyName: Cardlytics, Inc.

ticker: CDLX


text: Operational Disruption: Cybersecurity incidents may disrupt operations, including online banking services, payment processing, and customer support, resulting in financial losses and operational inefficiencies.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, cybersecurity risk assessments, external audits, and program development and enhancement where applicable.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk. This team, reporting to and working with the Chief Information Security Officer ("CISO"), identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion. In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident, as well as a business continuity plan that is designed to provide a clear framework for how the Company can continue in the event of any significant disruption in an effort to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks, such as conducting annual third-party penetration testing.

companyName: TELOS CORP

ticker: TLS


text: As a company that deals with large volumes of sensitive customer information and financial transactions, Regions treats cybersecurity risk as a key operational risk within its enterprise-wide risk management framework. As part of this framework, Regions utilizes the "Three Lines of Defense" concept to clearly designate risk management activities within the Company, and this concept is applicable to cybersecurity risk (see the "Risk Management" section of Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K). To manage cybersecurity risk, the Company has designed and implemented an IS Program that is led by our Chief Information Security Officer. The IS Program includes information security policies, procedures, and controls designed to prevent, detect, limit and respond to cyber-attacks or other similar incidents which might impact Regions' technologies, systems, and networks. Regions' IS Program is designed and implemented to substantially align with standards promulgated by the NIST. Regions' Information Security Policy establishes technical, administrative, and physical control directives that are implemented to protect informational assets from reasonably foreseeable risks and threats. The IS Program is supplemented by cybersecurity operations that protect the integrity and availability of information systems. As discussed above, Regions' TPRM function also conducts due diligence and ongoing oversight of the Company's third-party vendors. The Company maintains a Cyber Incident Response Plan, which is part of broader business continuity planning and the Crisis Management Program, to help the Company respond to a possible data breach.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer ("CIO") who has nearly 30 years of relevant work experience. Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a way that mitigates cybersecurity risks. Our CIO reports on a quarterly basis to Huron's internal Information Security Management System ("ISMS") Committee, which has primary responsibility for assessing and managing material cybersecurity risks. The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders, reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: The Audit and Risk Committee, its Cybersecurity Subcommittee, and management's Cyber Governance Committee receive regular reports on our information security program, including top risks, strategy, controls, incident response plans, metrics, and training protocols. Reports are also shared with the full Board of Directors.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, data centers, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery / business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third party tools to secure IQVIA information infrastructure and protect systems and information from unauthorized access. We manage risk in our supply chain through engagement with suppliers and vendors, including vendor on-boarding risk assessments, ongoing oversight, and independent cyber-reputation score monitoring for key suppliers.

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Information Technology Systems, Data Security and Data Privacy."

companyName: GERON CORP

ticker: GERN


text: Luxfer's cybersecurity program is managed by our IT Steering Committee. Comprised of IT Managers from across the company and chaired by a member of Luxfer's executive leadership team, the IT Steering Committee maintains the vision, strategy, and operation of Luxfer's cybersecurity program. IT Managers, who have operational responsibility for the actions of the Committee, ensure the effective implementation of the Company IT policies and also manage the local IT teams to ensure they are appropriately supported. Local IT teams have the day-to-day responsibility for implementing and monitoring the operation of Company IT policies within their respective business units. IT personnel within the Company are qualified within their respective roles and are provided with the resource to carry out their responsibilities effectively.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Account, and other products, subsidiaries and affiliates of TIAA and their respective third party service providers.

companyName: TIAA REAL ESTATE ACCOUNT


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our ERM process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for operation of the ERM program and risk management, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Our internal professionals collaborate with external subject matter specialists, as necessary. All third parties engaged for such matters are subjected to scrutiny to ensure they satisfy our security standards. We periodically review our third party engagements to ensure that the providers maintain the necessary levels of protection and competency, as well as to oversee and identify potential cybersecurity risks and/or threats from such engagements.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: As a global leader in animal health, we are reliant on complex information systems and digital solutions that make us inherently vulnerable to malicious cyber intrusion and attack. In addition, we have expanded our data and digital capabilities including in our diagnostics portfolio, and as a result, there could be an increased likelihood of a cyberattack or breach of security that could negatively impact us or our customers. Despite the presence of these risks, to date, the identified risks of cybersecurity threats (including as a result of any previous cybersecurity incidents) have not materially affected, and are not reasonably likely to materially affect, us or our business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Zoetis Inc.

ticker: ZTS


text: Cybersecurity incidents are managed through the Agility Plan, and other appropriate response policies, which provide direction to management allowing for the timely transfer of information throughout the organization. Our policy requires material incidents to be reported within 36 hours after an incident is determined to be material with the materiality determination to be completed without unreasonable delay. The CMT has developed a plan to facilitate making timely determinations as to whether and when incidents should be disclosed. If a material incident occurs, the Company will describe in detail the material aspects and nature, scope and timing of the incident, along with the impact to its financial condition and results of operations via the timely filing of Form 8-K.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the five core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond and recover.

companyName: RLI CORP

ticker: RLI


text: We recognize cybersecurity as an enterprise risk, and accordingly cybersecurity risk has been integrated into our overall risk management process. As part of our overall enterprise risk management process, we have established our management-level Risk Committee, composed of our Chief Information Officer, Chief Information Security Officer, Chief Legal Officer and Chief Financial Officer, among others, which assesses overall risks to the Company based on input from our other business leaders. We have also implemented an incident response process that is overseen by our Chief Information Security Officer, who reports to the Chief Information Officer and is supported by a multi-level incident response process led by our cybersecurity team. This is a documented framework that addresses our processes to assess, identify, and manage material risks from cybersecurity threats and incidents, which are prioritized for response and remediation efforts. Our incident response process includes analysis of the impact of a cybersecurity threat or incident for materiality to ensure proper reporting. Our incident response process is continually enhanced and validated through tabletop exercises and engagements with third-party partners.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Risk Assessment: On a regular basis, the Company conducts assessments to identify potential cybersecurity threats and vulnerabilities within its systems and networks. This includes evaluating the impact of potential breaches and the likelihood of occurrence.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Once cyber incidents are identified in the CDC, a risk assessment is performed as part of the CSIRP by the CDC. The risk assessment includes quantitative and qualitative considerations determined by a committee of individuals, including, among others, the Controller, CISO and Chief Ethics and Compliance Officer, that report to the Chief Financial Officer, CIO, and Senior Vice President General Counsel and Chief Sustainability Officer. Any cyber incidents that exceed set thresholds in the CSIRP are then escalated to the aforementioned committee for a materiality assessment and disclosure considerations.

companyName: PUGET ENERGY INC /WA


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct periodic tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2023 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. Risk Factors - IV. Operational Risks - A disruption in or failure of our IT systems, including those related to cybersecurity, could adversely affect our business operations, reputation and financial performance.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: The technology team is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The technology team implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Director of IT will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. to Board of Directors cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President. Our CIO has over 35 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.

companyName: TUTOR PERINI CORP

ticker: TPC


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: MidCap Apollo Institutional Private Lending


text: To identify and assess material risks from cybersecurity threats, we use a risk assessment process aligned with standard industry frameworks such as the National Institute of Standards and Technology, or NIST, International Organization for Standardization, or ISO, 27001 and other industry standards. We engage in regular network and endpoint monitoring, vulnerability assessments, and penetration testing, among other exercises. We continuously monitor threats and unauthorized access to our network through both internal and external third-party resources. We have developed incident response plans which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We provide annual privacy and security training for all employees which incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.

companyName: RESMED INC

ticker: RMD


text: We recognize that cyber threats are constantly evolving, and we must stay ahead of risks and threats to our business systems, data, infrastructure, and employees. We take a holistic approach to cybersecurity to proactively mitigate and respond to cyber threats. Building a robust security program and security controls are critical components that are in the core foundation of our products, culture, and management oversight. As a financial transaction processor, we ensure security is embedded and regarded with importance across the organization and within our products and services. We recognize the criticality of maintaining the safety, security, and integrity of our systems and data to protect our customers, employees, partners, and shareholders. The security program and cybersecurity strategies are strongly supported by both executive management and our Board of Directors. Our executive management fosters a strong culture of security awareness and responsibilities from the tone at the top and across all functional teams at all levels. The security team leadership also conducts segment level Board and/or periodic meetings with segment business leadership to share security key performance indicators ("KPIs") and risk considerations, as well as align with business strategies and gain approval for financial support for cybersecurity resources and tools. Security leadership is also involved in financial forecasting for security needs and costs, and the Chief Technology Officer ("CTO") and Chief Financial Officer or executive management team is involved in understanding and approving security related investments and strategies. We invest in our cybersecurity personnel and protections to address critical risks to our infrastructure and systems, and we remain dedicated to continuous improvement in our cybersecurity program.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed. These assessments incorporate various activities including information security assessments and independent reviews of our information security control environment and operating effectiveness. We utilize managed detection and response systems, endpoint protection, content filtering aimed at blocking malware and software to eliminate phishing, ransomware, and fraud. We also utilize multi-factor authentication on all sensitive applications and information entry-points, review access to data regularly, and have failover-protected business disaster recovery and backup storage systems. The Company conducts cybersecurity training and testing programs regularly.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise Risk Management Plan which is reviewed by management on a regular basis.

companyName: Landos Biopharma, Inc.