text: As part of our broader risk management and control framework, we have implemented cybersecurity controls over the information technology and process control systems of the Company and of our third-party service providers, to support the oversight, identification, and remediation or mitigation of risks from cybersecurity threats. We engage third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer, and vendor data as well as data affecting our process controls and data used to operate our manufacturing facilities. As part of our cybersecurity risk management program, we conduct information security and data protection training for employees, including training on matters such as phishing, social engineering, cybersecurity awareness, and email security best practices. In addition, we work with third-party providers to undertake penetration testing and maturity assessments of the Company's information security program based on the National Institute of Standards and Technology cybersecurity framework. With respect to third-party service providers, we perform information security assessments and due diligence reviews prior to entering into a contractual agreement. Further, after engagement, we periodically perform information security assessments of certain third-party service providers that we consider critical to our operations. In addition, in new or amended supplier contracts, we look to include provisions that require the suppliers to maintain an effective information security management program and to notify us in the event of a known or suspected cyber incident. For suppliers with required access to our data or systems, a cybersecurity risk assessment is performed to identify potential risk to Company systems or data. If risks are identified, we implement measures to mitigate or remediate the risk and, in cases where we cannot do so effectively, we will not grant access to our data or systems to the supplier. We also consult with external advisors and specialists, as necessary, regarding opportunities and enhancements to strengthen our cybersecurity practices and policies and implement enhancements to our cybersecurity capabilities based on evolving threats.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: NEVRO CORP

secItem: Item 1C


text: Consistent with our overall risk management governance structure, the Vice President of IT Infrastructure and Security ("VP of IT Security") is responsible for the day-to-day management of cybersecurity risk, while our Board of Directors and its Audit Committee play an active, ongoing oversight role.

companyName: SEMTECH CORP

ticker: SMTC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of IT Security and Vice President of IT. Our Director of IT Security has over 13 years of experience leading IT security and has certifications including CISSP and CCSP. Our Vice President IT has over 20 years of experience in IT, data engineering, and data analytics.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.

companyName: Regulus Therapeutics Inc.


text: We have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and ensure the effectiveness of our security controls. Our cybersecurity risk management program is intended to address applicable NIST 800-171 and CMMC requirements. Our cybersecurity risk management program incorporates several components, including information security program assessments, continuous monitoring of critical risks from cybersecurity threats using automated tools, backup testing, and employee training. We deploy a wide range of security tools, require multifactor authentication across all systems, and utilize access control policies to further limit access to data within the systems.

companyName: Inrad Optics, Inc.


text: The Company's Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has significant experience in information technology and many of our information technology team members hold qualifications in technology security positions. We maintain a cross-functional Cybersecurity Committee, as well as a Global Security Committee consisting of the information technology professionals and security managers from each country in which we have operations.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: Cybersecurity Program Components Our cybersecurity program structure consists of our cybersecurity operations center; identity and access management; governance, risk, and compliance; architecture; and operational technology. Aspects of our program include:

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Phoenix's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Phoenix's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Phoenix's management on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.

companyName: PHOENIX MOTOR INC.

ticker: PEVM


text: Risk Management and Strategy BOK Financial is committed to safeguarding company and client information through protections integrated into all lines of business, support functions and third-party relationships. To effectively manage cybersecurity risks mentioned in Item 1A, our cybersecurity risk management program evaluates the likelihood and potential damage of internal and external threats. We also evaluate the adequacy of our policies, procedures, and capabilities in place to mitigate cyber risk at least annually.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Our cybersecurity program is integrated into our broader enterprise risk management framework. For example, certain members of our executive management evaluate material risks from cybersecurity threats against our overall business objectives and report to our Audit and Risk Committee (Audit Committee) of the Board of Directors, which evaluates our overall enterprise risk.

companyName: Everpure, Inc.

ticker: PSTG


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material are then communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in an 8-K within 4 business days upon such determination.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: The Company maintains cybersecurity insurance coverage intended to protect against loss of business and other related consequences resulting from cyber incidents. Matthews reviews its insurance coverage annually for adequacy against operations and information systems. However, there can be no assurance that the Company's cyber liability insurance coverage will be available to it or provide adequate coverage in the event of a cybersecurity incident.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Team and Strategy — The cybersecurity team, led by the interim CSO, is responsible for managing the day-to-day cybersecurity strategy of the organization. Including oversight of our cybersecurity tools and controls to protect company assets. We have implemented an iterative and multi-layered cybersecurity strategy that incorporates both proactive review of the evolving cybersecurity threat landscape and reactive management of cybersecurity threats. Our proactive management of cybersecurity risks includes zero trust access, data loss prevention programs, correction of potential cybersecurity risks, and programs for employee education regarding cybersecurity risks. Our reactive management of cybersecurity risks includes continuous logging and alerting, utilization of enterprise cybersecurity technology, and personnel dedicated to incident response.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: As referenced in the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K, our organization may be materially affected by cybersecurity threats and incidents that target its internally managed information technology systems or our critical vendor systems.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: As further protections, we utilize encryption, access control mechanisms and secure cloud infrastructures, and we invest in extensive user training. All users regularly undergo updated cybersecurity awareness training in an ongoing effort to reduce the risk of human error contributing to any potential security incidents. All users are also subject to simulated phishing emails with real time feedback for a more continuous layer of training.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Our advisor regularly assesses risks from cybersecurity and technology threats and monitors our information systems for potential vulnerabilities. Our advisor uses a risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. Our advisor conducts regular reviews and tests of our information security program to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Moody National REIT II, Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Workday, Inc.

ticker: WDAY


text: The Committee is responsible for escalating key risks members of Executive Management not serving on the committee as well the Board of Directors. audit over cybersecurity related activities is completed by an independent third party.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, penetration tests, vulnerability scanning, internal audits, and external audits of our cybersecurity program. We also leverage assessors, consultants, auditors and third-party service providers, including threat intelligence to inform our understanding of the cybersecurity threat landscape and enable risk-based measures to defend against evolving threats.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Our cybersecurity awareness program provides training for all global employees at onboarding and subsequently three times every year. In 2023, across our organization, employees completed over 16,000 training classes related to cybersecurity. Additionally, in 2023, to elevate cybersecurity awareness, we also conducted live training as part of our Employee Development program, sent monthly phishing tips to all employees and provided weekly communications during October, which is cybersecurity awareness month.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: We have implemented and maintain a cybersecurity risk management program through our security steering committee, which is designed to assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. The members of our security steering committee represent the following functional areas: cybersecurity and infrastructure; corporate risk and privacy; personnel; and finance and fraud management. The security steering committee collaborates with and manages third parties, as appropriate, to assess the effectiveness of our cybersecurity prevention and response systems and processes. These third parties may include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. To protect our information systems from cybersecurity threats, we also ask our employees to take periodic cybersecurity training and we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Lifevantage Corp

ticker: LFVN


text: We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments. We deploy both commercially available solutions and proprietary systems to manage threats to our information technology environment actively.

companyName: Mission Produce, Inc.

ticker: AVO


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our security measures, however, we are unable to eliminate all cybersecurity threats. Accordingly, there can be no assurance that we have not experienced undetected security breaches or incidents, or that we will not experience a security breach or incident in the future. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Seagate Technology Holdings plc

ticker: STX


text: In the event of a cybersecurity incident, we intend to follow an incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel and the Board and the Audit Committee. It is possible that the occurrence of any cybersecurity incidents, or a combination of them, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. We have not encountered any cybersecurity incidents since the Initial Public Offering.

companyName: Cantor Equity Partners I, Inc.

ticker: CEPO


text: We have developed and implemented a cybersecurity and information security risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader risk management system and processes. The cybersecurity risk management system involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from consultants, cybersecurity assessors, auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We depend on and engage various third parties, including suppliers, vendors, and service providers. Our risk management, legal, information technology, and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to Mr. Srinivasan, our designated member of our Board of Directors.

companyName: WRAP TECHNOLOGIES, INC.

ticker: WRAP


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan with dedicated Cybersecurity Event Response and Corporate Crisis Management Teams, including maintaining a 24/7 security operations center ("SOC"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection safeguards; • Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; • Educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and • Reviewing and evaluating new developments in the cyber threat landscape.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Our ISO reports directly to our Senior Vice President, Chief Information Officer (CIO), who is a member of the committee. She has held this role at Dexcom since 2024 and is responsible for global information technology at Dexcom. Our CIO brings 30 years of diverse strategic and operational experience in IT management, data engineering, AI, digital, ecommerce, infrastructure modernization and supply chain. Prior to Dexcom, our CIO served as Senior Vice President, Chief Information Officer at Bausch + Lomb. Additionally, our CIO has held transformational roles at Johnson & Johnson, Bristol Myers Squibb, American Standard and Price Waterhouse Coopers. She holds a Bachelor of Science degree in Economics and Management Information Systems from the University of Delaware. Our Executive Vice President, Chief Technology Officer (CTO) is also a member of the committee. Our CTO has held this role since 2022 and has 25 years of experience spanning consumer electronics, data storage, IoT and broadband industries. From 2011 to 2022 he worked at Technicolor (now known as Vantiva), most recently serving as Chief Technology Officer and General Manager of the Broadband Business Division. In addition to an MBA, he holds a Master of Science in Mechanical Engineering and a Bachelor of Mechanical Engineering.

companyName: DEXCOM INC

ticker: DXCM


text: A core aspect of the Company's business relies on technology and software; as a result, the security of those technologies and software, as well as the protection of the confidential information entrusted to the Company by its customers, are key components of the Company's business and strategy. DFIN maintains many processes for identifying, assessing and managing material risks from cybersecurity threats. These processes are applied throughout the organization and are monitored, updated and assessed. DFIN has developed cybersecurity risk management processes that are integrated into the Company's overall risk management system and designed to be comprehensive. Risk management committees such as the Enterprise Risk Management Committee and the Ethics and Compliance Committee regularly review the Company's policies and procedures governing cybersecurity. These policies and procedures inform protocols that align cybersecurity risk assessment and mitigation to evolving risks and threat vectors that impact broader enterprise risk categories, promoting a comprehensive approach. These processes include the identification, assessment and management of material risks that are derived from cybersecurity threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Thought Leadership and Collaboration We leverage thought leadership from key vendors, business partners, and industry intelligence sources to stay abreast of emerging threats and align with best practices. This collaborative approach enables us to proactively respond to evolving cyber risks while effectively managing risk in line with our organizational risk appetite.

companyName: CONNS INC


text: Our Cybersecurity Management Team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Arteris, Inc.

ticker: AIP


text: The Company also has processes to identify and oversee cybersecurity threats associated with its use of third-party service providers. These processes include diligence of third-party cybersecurity risk through SOC-2 audits and use of independent vendors who provide cybersecurity ratings. In addition, the Company maintains an insurance policy which specifically provides coverage for qualifying information security breaches.

companyName: Turtle Beach Corp

ticker: TBCH


text: Our Board of Directors has technical and industry expertise in risk management, computer security and information technology matters. Specifically, the chairperson of the Committee has 40 years of experience in the cybersecurity field, was a former sub-chairman of the NIST Board of Assessment for Programs/National Research Council and holds CISSP, CRISC and CDPSE certifications.

companyName: VirnetX Holding Corp

ticker: VHC


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences any such incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: We have integrated cybersecurity risk into our broader enterprise risk management framework. Our cyber risk program leverages internationally recognized standards as appropriate. We use a combination of technology controls, human oversight and processes to actively monitor and protect our network and systems. All employees participate in a number of information security training programs. Employees receive training on how to spot and report cyber risks and events through our global cybersecurity awareness program. In addition, we hold cybersecurity risk insurance.

companyName: FLUOR CORP

ticker: FLR


text: At the management level, the Company has designated the Chief Risk Officer as the Chief Privacy Officer, who has oversight for managing cybersecurity risk. The Chief Privacy Officer coordinates with the Chief Information Security Officer to ensure the Company's cybersecurity risk profile is managed in a manner consistent with its risk appetite. The Chief Privacy Officer also provides periodic reports to the Board's Risk Oversight Committee, outlining the overall status of the Company's Information Security Program and its compliance with regulatory guidelines, and coordinating and reporting on incident response. The Chief Information Security Officer is responsible for the day-to-day management of the Information Security Program and Security Incident Response Policy and Plan. The Chief Privacy Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company's Chief Financial Officer. The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: As part of this process, appropriate personnel collaborate with third-party subject matter experts to gather insights for identifying and assessing material risks associated with cybersecurity threats, their severity, and potential mitigations. Further, we provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity event. our processes to benchmark standards, such as those set by the National Institute of Standards and Technology ("NIST"). monitor emerging data protection laws and implement changes to our processes as needed. annual cybersecurity management and incident training for employees involved in our systems that contain sensitive data.

companyName: I-ON Digital Corp.

ticker: IONI


text: As we have noted, increased adoption of AI technologies, especially Generative AI, may increase cybersecurity risks, so Argo Group has instituted an AI Policy specifically addressing such risks. Additionally, we have implemented additional technical controls to help safeguard against data loss to generative AI and have established a cross-functional AI Working Group, which meets on a periodic basis to ensure that the company remains abreast of any AI developments that may require changes to our security posture.

companyName: Argo Group International Holdings, Inc.


text: Our CISO leads the Information Security team and has global responsibility for overseeing our information security, data privacy and cybersecurity program. The program is operationalized through use of multi-disciplinary teams including governance, risk and compliance; identity and access management; cloud and infrastructure security; data security; application security; vulnerability and threat management; and security detection and response operations.

companyName: TYSON FOODS, INC.

ticker: TSN


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is managed separately from our other risk management programs.

companyName: Rent the Runway, Inc.

ticker: RENT


text: Risks from Cybersecurity Threats In the last fiscal year, we have not experienced any material cybersecurity incidents. For a full discussion of cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, result of operations, or financial condition, see Item 1A. Risk Factors.

companyName: Independent Bank Group, Inc.


text: We also engage consultants to assist us in monitoring and testing our safeguards. Performance of our cybersecurity controls for certain systems is periodically reviewed by our internal quality functions. We further require third-party service providers who will be handling our company's sensitive information to certify that they implement appropriate security measures, consistent with all applicable laws, to maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Risk Management and Strategy BD's cybersecurity risk management program is focused on maintaining the confidentiality, integrity and availability of BD products, manufacturing and distribution operational technology ("OT"), enterprise IT and BD data. We incorporate cybersecurity risk management into our systems and processes through a comprehensive program guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: We maintain an information security program as part of our enterprise-wide risk management system. Our information security program is managed by our Group Vice President, whose portfolio includes top level oversight of information technology, information security and IT risk management. The Group Vice president is responsible, along with his team, for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. Our Group Vice President has served in that role since 2012 and has been in cybersecurity related roles for 25 years. Our Group Vice President and IT Director provide periodic updates to our Board of Directors, Audit Committee, and other senior management members. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: Cybersecurity is a critical aspect of our operations, and our board of directors and management prioritize safeguarding our digital assets and ensuring the integrity and confidentiality of sensitive information to protect our assets, customers, and stakeholders. Our cybersecurity program is managed by our Global IT Director and overseen by our executive leadership team and board of directors. It encompasses risk management, a management framework, governance, education and training across the organization, SOC2 compliance, and an incident response protocol.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: We are actively engaged in identifying, managing, and mitigating cybersecurity risks with the objective of avoiding or minimizing the impact of malicious and non-malicious actions and threats aimed at penetrating, disrupting or misusing our systems and information. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is deemed critical. We have developed and implemented an enterprise-wide information security program, which is designed to protect the availability, integrity, and confidentiality of customer non-public information and company data, including the protection of the hardware and infrastructure used to store and transmit such information. Our Information Security Program is structured and aligned with the Federal Financial Institution Examination Council ("FFIEC") guidelines for information security, regulatory guidance, and other industry standards. To promote the continued effectiveness of our information security program, we periodically conduct risk assessments, complete audits and tests, participate in industry associations, and review information from threat intelligence feeds. In addition, our Chief Information Security Officer and members of his team and of our Information Technology team regularly collaborate with external parties, including regulatory agencies, other banks and industry groups to share cyberthreat information, trends and issues and identify best practices.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: At the management-level, the company's IT systems are overseen by our CIO, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who reports directly to the company's chief financial officer. The VP of Information Security has responsibility for information security strategy and operation. The VP of Information Security is responsible for managing and assessing material risks from cybersecurity threats. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Assessing the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: We also expect our suppliers to follow the same industry-standard security practices that we follow. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. The ability and availability of information to monitor the cybersecurity practices and controls of our suppliers is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in information systems, software, networks, and other assets owned or controlled by our suppliers. Although the Company attempts to manage its exposure to such events through the purchase of cyber liability insurance, such events are inherently unpredictable, and insurance may not be sufficient to protect the Company against all losses. There is no assurance that the Company's security systems or processes will prevent or mitigate future break-ins, tampering, security breaches or other cyber-related attacks.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: The Company has established an information security program that uses a risk-based methodology to ensure the confidentiality, integrity, and availability of its information. The Board and the Enterprise Risk Management Committee set enterprise risk strategy and make risk-informed decisions, which includes assessment and response to cybersecurity risk. The Board has appointed an Information Security Officer ("ISO") to oversee the program. The program utilizes a combination of automated tools, manual processes, and third party assessments to identify and assess potential cybersecurity threats. The program is supported by an organization structure that reflects support from across the business. Program objectives and results are regularly reported to the Enterprise Risk Management Committee, Audit Committee, and Board.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year. An advanced phishing simulation program exists at the Company and all employees are tested at least monthly on their ability to identify phishing emails.

companyName: GXO Logistics, Inc.

ticker: GXO


text: As of the date of this Form 10-K we do not believe that these risks or any previous cybersecurity events or incidents have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition refer to "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Form 10-K, which disclosures are incorporated by reference herein.

companyName: Bakkt, Inc.

ticker: BKKT


text: The costs associated with the Vendor Incident have not had, and neither it nor the SEC's investigation (including responding to any information requests from the SEC) are expected to have a material adverse impact on the Company's financial condition or results of operation.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. "Risk Factors", of this Form 10-K.

companyName: Phunware, Inc.

ticker: PHUN


text: Our IT consultant regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. Our Chief Executive Officer periodically reports information regarding our cybersecurity program to our Board, which has overall responsibility for risk oversight. In addition, our management is responsible for alerting our Board of any material cybersecurity incidents.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: We maintain a number of processes to identify and respond to cybersecurity threats and incidents including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercise, and recovery and resilience tests. Our information security and third-party risk management programs evaluate cybersecurity threats posed by internal and external factors and support daily operational functions that prevent unauthorized access or compromise.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: SMIS attends and is invited to all Company Cybersecurity Committee meetings, a cross-functional management committee that drives awareness, ownership and alignment across broad governance for effective cybersecurity risk management. The Cybersecurity Committee is composed of senior leaders from our legal, information technology, cybersecurity, and audit sections. Subject matter experts are also invited, as appropriate. The Cybersecurity Committee meets at least quarterly and has responsibility for oversight and validation of the Company's cybersecurity strategic direction, risks and threats, priorities, and resource allocation. The SMIS and his team, as well as the Cybersecurity Committee, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the Company's cyber incident response plan.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: Monitoring and assessing cybersecurity risk is a critical part of our overall enterprise risk management ("ERM"). Our Board regularly discusses significant areas of risk, including those that may be related to cybersecurity, as necessary. We have designed and implemented an information security program tailored to our operations, the nature of our products and services, and the sensitivity of the data that we process. We have implemented cybersecurity risk management processes that include, for example, developing organizational understandings to manage cybersecurity risk, identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities, and developing a vendor risk management policy for assessing supply chain and vendor-related risks. As part of these processes, we have implemented an Incident Response Plan, which provides protocols for incident evaluation, including processes for notification and internal escalation of information to our senior management and the appropriate Board committees. Our Incident Response Plan is updated annually and tested in tabletop exercises.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi-factor authentication for remote access and certain internal systems; • data loss prevention for email traffic containing sensitive information; • domain name service threat detection; and • internal incident response procedures based on NIST Special Publication 800-61.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: The Audit Committee receives periodic reports from company management, including our Chief Legal Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SCYNEXIS INC

ticker: SCYX


text: The Audit Committee also oversees Matson's ERM program, which includes cyber and information security risks. The ERM process, which follows the Committee of Sponsoring Organization Framework, is designed to promote visibility to the Board and management of critical risks and risk mitigation strategies across various time frames, including the short-, medium- and long-term. Risk mitigation efforts are integrated into strategic plans and budgets. The Chief Financial Officer and Head of Internal Audit review the Company's risk management activities with the Audit Committee and the Board on a regular basis. Management also regularly updates the full Board at and between Board meetings on the ERM program and other risk-related matters. In addition, executive sessions of the Board, which are led by the Lead Independent Director, have focused on certain risk oversight topics from time to time. The Lead Independent Director consults with the Chairman of the Board regarding risk-focused topics at Board meetings.

companyName: Matson, Inc.

ticker: MATX


text: Our management team, including our CSO and CISO, is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our CSO's and CISO's experience includes years of working in the cybersecurity field in various industries, including the financial services industry.

companyName: Coinbase Global, Inc.

ticker: COIN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or consumers; violation of data privacy or data security laws and other litigation and legal risk; and reputational risks.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: We assess, identify, and manage material cybersecurity risks in a number of ways. Our global security and resiliency organization, under the leadership of our Chief Security Officer ("CSO"), has established an internal governance structure to identify, assess, rate, and manage cybersecurity risks across the Company in an integrated manner. The security and resiliency organization advises each business unit and functional area on addressing cybersecurity risks and monitors initiatives to mitigate and manage such risks over time. Each business unit or functional area is responsible for managing risks and ensuring that security and resiliency policies and standards are implemented within the respective business unit or function. Compliance with our internal security and resiliency policies and standards is assessed by our internal audit team, which has a dedicated cybersecurity audit function.

companyName: Dell Technologies Inc.

ticker: DELL


text: Cybersecurity incidents are assessed for actual or potential impact on the business and any relevant data subjects. Materiality of cybersecurity incidents is assessed and determined by the Cybersecurity Team, which has been assigned this responsibility by our Disclosure Committee. The Cybersecurity Team consists of the Chief Financial Officer, the General Counsel, the Vice President - Commercial Excellence, the Vice President - Global Systems and the Senior Director - Information Security. The Senior Director - Information Security reports regularly to our Disclosure Committee. In the event a cybersecurity incident is determined to have, or is likely to have, a material impact on the Company, the Chair of the Audit Committee of the Board of Directors is directly notified by the General Counsel in coordination with the Chief Financial Officer and Senior Director - Information Security.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: R isks from Cybersecurity Threats While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. As of December 31, 2023, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.

companyName: Energy Recovery, Inc.

ticker: ERII


text: A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), has responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: We are committed to protecting the privacy and security of our information assets and the data entrusted to us. Our cybersecurity program comprises multiple levels of physical, technical, and administrative safeguards. Our cybersecurity program is informed by industry standards, including the Center for Information Security (CIS) framework for security controls and benchmarks, the National Institute of Standards and Technology (NIST) standards, and the ISO 27000 framework. This does not imply that we meet any particular technical standards, specifications, or requirements at all times, only that we use CIS, NIST, and ISO 27000 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: Managing cybersecurity risk and maintaining secure, reliable, and functional systems are among our highest priorities. Therefore, we have implemented tools, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment, and a reliable cybersecurity posture We maintain an information security program comprised of policies and controls designed to reduce our cybersecurity attack surface and to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our Chief Information Officer (CIO), Rui Mendes, leads our cybersecurity initiatives. Our CIO's experience includes co-founding 3RDGP Limited/Corsario, a third-generation payments company, specializing in issuing and acquiring technology solutions. Prior to 3RDGP, he co-founded Carta Worldwide, a global leader in digital enablement and payments processing technology. Mr.

companyName: Spectaire Holdings Inc.


text: We employ an array of controls, technologies, and other processes designed to identify, protect against, detect, respond to, and mitigate cybersecurity risks. These measures are in alignment with the frameworks established by the National Institute of Standards and Technology (NIST). Our IT activities are primarily outsourced for monitoring and maintenance to third parties and are subject to independent controls over IT. These controls include but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We consistently evaluate and enhance the effectiveness of our cybersecurity program, ensuring continuous evolution and improvement.

companyName: BT Brands, Inc.

ticker: BTBD


text: While the Company believes it has adequate processes and technology in place to detect and respond to cybersecurity threats, the Company is continually at risk given an ever-changing cybersecurity landscape. Accordingly, the Company can provide no assurances that a future cyber-attack would not impact the Company's business in a material manner. At the effective date of this report filing, however, the Company is not aware of any current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on risks related to the Company's information technology systems, including cybersecurity threats that may materially affect the Company's business, see the risk factors included under Item 1A of this Annual Report on Form 10-K ("We Rely Heavily on Information Technology Systems to Operate Our Business. Any Disruptions to These Technology Systems or if These Systems were Made Unavailable for Use, May Have a Material Adverse Effect on Our Business").

companyName: AMCON DISTRIBUTING CO

ticker: DIT


text: Our Board of Directors maintains overall responsibility for overseeing the Company's risk management framework, and cybersecurity represents an important component of the Company's overall risk management framework. The Board regularly reviews risks that may be material to the Company. The Audit Committee assists the Board in the oversight of cybersecurity and other technology risks. Through receiving regular reports from the Chief Technology Officer ("CTO") and the Chief Legal Officer, the Audit Committee discusses with management cybersecurity risk mitigation and incident management, and reviews management reports regarding the Company's cybersecurity governance processes, incident response system and applicable cybersecurity laws, regulations and standards, status of projects to strengthen internal cybersecurity management, the evolving threat environment, vulnerability assessments, specific cybersecurity incidents and management's efforts to monitor, detect and prevent cybersecurity threats. On top of that, significant cybersecurity incidents will be immediately reported to the Board in accordance with the Company's incident response plan.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: We and NTS, and NTS's successor, IPM, which manages our IT infrastructure and cybersecurity under the direction of our CTO, have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:

companyName: NewtekOne, Inc.

ticker: NEWT


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition, results of operations, or cash flows. See " Risk Factors – Risks Related to Our Business – We could be adversely affected by information security breaches or cyber security attacks."

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Our cybersecurity risk management program is led by our Vice President of Information Security, who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents; cross-functional coordination; and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to prepare appropriate responses and respond to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of and improvements to, among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management; • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team with the assistance of external consultants.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our ISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our ISO (in coordination with our CSIRT) is also responsible for other functions, including preparing for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our CSIRT reviews, approves and prioritizes information security and cybersecurity policies, projects and initiatives. Executive management is responsible for prioritizing initiatives and approving budgets to allocate funding for the foregoing based on feedback from the ISO, the CSIRT and the Audit Committee.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards, and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing, and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.

companyName: Gold.com, Inc.

ticker: GOLD


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected, and we do not believe they are reasonably likely to materially affect, our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber-attacks or other failures in our telecommunications or IT systems, or those of our collaborators, CROs, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations" in Item 1A- Risk Factors.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Detecting and Responding to a Cybersecurity Incident As noted previously, both we and our vendors (to the extent contractually required) monitor systems for potential incidents. We are working with our vendors to determine the applicable warning flags and thresholds and appropriate notification processes based on the services provided and type of data processed.

companyName: Portillo's Inc.

ticker: PTLO


text: Our information technology ("IT") systems are critically important to our existing business operations and growth strategy. We provide services to individuals and others that require us to collect, process, maintain and retain sensitive and personal client confidential information in our IT systems, including protected health information ("PHI"), personally identifiable information ("PII"), financial information and other personal information about our customers and end-users, such as names, addresses, phone numbers, email addresses, identification numbers, sensitive health data, and payment account information. As a result, we are subject to complex and evolving United States privacy laws and regulations, including those pertaining to the handling of personal data, such as HIPAA and CCPA. In addition to protecting the privacy of all health-related information for our members, our IT infrastructure supports the operations of all aspects of our business and ensures that we are able to continue to serve our members' transportation, personal care, and monitoring needs and execute our strategy to better connect people with care.

companyName: ModivCare Inc

ticker: MODVQ


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants (e.g., Cobalt, Crowdstrike and EY) to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: We engage third-party experts, including auditors, consultants and advisors, to evaluate and enhance our cybersecurity program through security certifications, assessments and testing. Wesco's cybersecurity programs are reviewed as part of our information security management system ("ISMS") by external, independent third-party auditors. We have received ISO 27001 certification for our ISMS and we undergo annual audits by an independent accreditation body to maintain this certification. We also engage third-party consultants to perform penetration and vulnerability tests at least once per quarter, as well as annual "red team" engagements that simulate cyber threats. The results of these tests and assessments are used to establish priorities, allocate resources, and improve controls. We conduct mandatory information security awareness training for all new hires and employees at least annually as well as specialized training for certain functions, such as developers, platform administrators and finance personnel. We have instituted regular phishing, social engineering and other malicious attack simulations, generally at least once per quarter, to enhance our employees' awareness and responsiveness to such possible threats. We run several awareness campaigns each year covering a variety of topical cybersecurity subjects and we maintain an internal website that is accessible to all employees that has security policies, additional trainings, and current news events. Our security policies and trainings are regularly evaluated and updated to adapt to changing regulations and emerging cybersecurity risks. Our training program also includes expert guest speakers and additional training during cybersecurity awareness month each October.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Ellington's cybersecurity team is lead by Ellington's outsourced Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has lead large technical efforts such as the development of Ellington's proprietary whole loan management system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has lead several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.

companyName: Ellington Financial Inc.

ticker: EFC


text: Security risks are assessed on a regular basis, at least annually, taking internal as well as external risk drivers and events dynamically into account. A thorough analysis of the external threat landscape, which leverages industry standard threat assessment frameworks, provides a foundation for the assessment of financial industry relevant risk scenarios. These are evaluated against Deutsche Bank Group's capabilities to cope with these risks. In case of emerging developments, additional risk reviews are conducted.

companyName: RREEF Property Trust, Inc.


text: YETI's cybersecurity program has been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. The enterprise risk framework is integrated with our annual planning, internal audit scoping, and management process. Our internal audit team annually facilitates an enterprise risk assessment with senior management and, through this process, we identify and assess material risks impacting our company and our operations and strategic objectives, which includes information technology and security risks. Management and the Board rank YETI's risks based on their potential impact to YETI's ability to meet our strategic priorities. Management determines appropriate risk responses for each identified enterprise risk. Outside of this annual process, management is responsible for our day-to-day risk management activities.

companyName: YETI Holdings, Inc.

ticker: YETI


text: Key elements of our corporate-level cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical corporate network systems and corporate information; • a security function principally responsible for managing at the corporate-level (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our corporate security controls; • a cybersecurity awareness training of our corporate employees, incident response personnel, and senior management; • cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents that impact Xenia's corporate systems and information; and • a third-party risk management process for key service providers, suppliers, and vendors that support our corporate functions based on our assessment of their respective risk profiles.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: See "We face risks related to the occurrence of cyber incidents, or a deficiency in our cybersecurity, which could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results" included as part of the risk factors described in Item 1A of this Annual Report on Form 10-K for additional information on the potential impact any cybersecurity incident may have on our business, results of operations, financial condition and cash flows.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Managing cybersecurity risks is an important component of the Company's approach to enterprise risk management. Our enterprise risk management approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's and customer's information; and (iv) protect our intellectual property.

companyName: Augmedix, Inc.


text: Management of Third-Party Cyber-Risk We rely on third-party vendors to provide supplemental benefits to our members and for a variety of other key business functions. Accordingly, our vendor onboarding process includes a comprehensive security assessment. Moreover, at least quarterly, we assess the risks from cybersecurity threats relating to each of our member-facing and other key third-party service providers with whom we share protected health information, personal identifying information and confidential information. We generally require our suppliers to adopt security-control principles based on industry-recognized standards and we seek audit rights over their security protocols.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: We consider cybersecurity as part of the enterprise risk process, including organized and structured reporting protocols. The prioritization of cybersecurity risk is aligned with overall risk management processes.

companyName: IPALCO ENTERPRISES, INC.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: The Company's cybersecurity efforts are led by the Chief Information Security Officer (" CISO "), who reports to the Chief Information Officer ("CIO") and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has proven cyber operations and cyber risk management experience, having previously worked for UK law enforcement and leading organizations in the financial services, health and advertising sectors. Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional. The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cybersecurity disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents. Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board ("IEB") and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee ("ISC").

companyName: Information Services Group Inc.

ticker: III


text: Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: 374Water Inc.

ticker: SCWO


text: phishing simulations at regular intervals (not less than quarterly) to all users of the company's email system; and a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the company or the company's confidential or proprietary information or otherwise is connected to any company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the company's cybersecurity team may propose contractual remediation obligations to be agreed upon by the vendor.

companyName: Endeavor Group Holdings, Inc.


text: Our management team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our business processes and our overall risk management strategy, and communicating key priorities to relevant personnel. Our management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Akili, Inc.


text: As part of our overall risk management, our cybersecurity program is focused on a comprehensive approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Pluri Inc.

ticker: PLUR


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports, with a minimum frequency of once per year, from our Senior Vice President, Controller and Principal Accounting Officer on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the Audit Committee would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity breaches.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as applicable. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which material incidents would be communicated to executive management, our BOD, external regulators and shareholders. • Enterprise-Wide Coordination: We engage experts from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.

companyName: PFIZER INC

ticker: PFE


text: The risks associated with the cybersecurity landscape are vast and ever-changing. Additionally, as a financial institution, the Corporation is subject to extensive federal and state regulatory and compliance requirements, many of which are associated with the protection and privacy of customer information. In response, the Corporation has created a layered and adaptable Information Security Program to protect the confidentiality, integrity, and availability of proprietary information and customer data. Continuous assessment and improvement of Information Security procedures and controls remains an integral part of the Corporation's overall risk management strategy and on-going business operations.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: We have not had cyber incidents that have materially affected our business or financial condition. For details about our risks associated with cybersecurity threats, see "—Computer system interruptions or security breaches of our information systems could significantly disrupt our product development programs and our ability to operate our business." in the section titled "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.

companyName: Nkarta, Inc.

ticker: NKTX


text: We rely on information technology and other systems and any failures in our systems could disrupt our business and adversely impact our results.

companyName: PlayAGS, Inc.


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which uses a top-down approach to identify and prioritize key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Our cybersecurity strategy takes a defense-in-depth approach, with layered controls consisting of both commercially available and proprietary technologies that are intended to prevent an adversary from conducting a successful attack. Included in that approach is our Cyber Threat Center which is a critical component of our Cybersecurity Program and operates internally with the purpose of monitoring, detecting, and responding to cyber threats that could jeopardize the integrity, confidentiality, or availability of information systems. Our Cyber Threat Center operates 24 hours per day, 7 days per week, continuously monitoring our systems for signs of tampering or unauthorized activity, utilizes an incident response playbook which is based on NIST industry best practices, and includes containment and recovery procedures. Furthermore, we maintain cybersecurity insurance coverage which provides certain limited protection.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Our internal information technology systems, or those of our third-party CROs, CMOs, or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug candidates' development programs and our commercialization of any products for which we receive regulatory approval."

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: The Company's Chief Information Officer is responsible for the Company's cybersecurity team and for reporting to the Audit Committee of the Board of Directors. The Company's corporate security team reports directly to the Chief Information Officer. Our Chief Information Officer has more than thirty years of experience managing communication networks, data centers, information technology teams, systems administration and cybersecurity in the media and advertising industry. Our corporate security team is similarly composed of seasoned professionals with significant experience in the field. The Chief Information Officer regularly informs the Company's senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The corporate security team has a broad range of experience selecting, deploying and operating cybersecurity technologies initiatives and seeks to ensure that each team stays educated on emerging technologies and threats.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Our board retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: A dedicated cybersecurity team lead by a cybersecurity manager and director of security oversee the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's director of security. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.

companyName: IDACORP INC

ticker: IDA


text: In addition, we have a written cybersecurity incident response plan ("Response Plan") that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer ("CISO") and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), our Board and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit and legal departments under the supervision of the CEO and CFO.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: We engage third-party service providers as part of our cyber risk mitigation efforts. We contractually require vendors with access to personal information to maintain sufficient cybersecurity and data privacy standards. As part of our PCI compliance program, we assess vendors with access to payment card data on an annual basis, and we review other critical vendors periodically and on an as-needed basis. We also maintain relations with local and federal law enforcement in connection with cybersecurity matters.

companyName: Aramark

ticker: ARMK


text: We use various internal organizational cybersecurity and privacy safeguards, controls and procedures for the discovery, identification, classification, assessment, and management of cybersecurity incidents and material risks associated with our corporate business systems, our product and service offerings, and third-party supplier relationships. Incident response plans and procedures are in place for the detection and response to cybersecurity incidents and events that may adversely affect the confidentiality, integrity or availability of our corporate business systems, our product and service offerings and third-party supplier dependencies. Our incident response plan includes a materiality assessment framework used for escalation protocols, navigation of materiality assessment determinations and procedures for post determination actions. Our incident response team includes our Senior Director of Cybersecurity, representatives from legal and delegates from our product engineering teams and corporate information technology teams. The incident response team will engage third-party incident management experts, including outside legal counsel, as necessary. Our Senior Director of Cybersecurity will provide updates to the internal audit team and our senior management team regarding any such incident until it has been addressed.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Additionally, the Cybersecurity Program includes quarterly general cybersecurity awareness and data protection training for employees as well as regular phishing simulations. The Company also has annual certification requirements for employees with respect to certain policies supporting the cybersecurity program including the IT, Cybersecurity and Physical Security Policies and Procedures, the Disaster Recovery Business Continuity Plan, the Electronic Communications Policy and the Privacy Policy.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Park maintains comprehensive technologies and programs to help ensure our information technology and systems are effective and prepared for data privacy and cybersecurity risks, including oversight of our programs for security monitoring for internal and external threats to help ensure the confidentiality, availability and integrity of our information assets.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives briefings from the CIO regarding the Company's cybersecurity risk management program at least annually. These briefings include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: Seneca Foods Corp

ticker: SENEA


text: For a description of the risks related to cybersecurity that may materially affect us and how they may do so, see the "Risk Factors—Risks Related to Cybersecurity" section of this Report.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: We recognize that cybersecurity threats are constantly evolving, and we have implemented risk management procedures designed to protect our systems and data. We conduct vulnerability assessments, and periodic audits to identify and address potential cybersecurity vulnerabilities. We conduct periodic assessments to identify material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response to those findings. As part of our efforts to safeguard our systems and data, we have sought to implement industry-standard security controls, including firewalls, encryption, and multi-factor authentication.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: The Company's Director of Infrastructure & Security leads its cybersecurity program and reports to the Company's Vice President of Information Technology. The Director of Infrastructure & Security is responsible for management of cybersecurity risk and protection and defense of the Company's networks and systems. The Director of Infrastructure & Security manages a team of cybersecurity professionals with broad experience and expertise, including in incident response, forensics, threat intelligence, vulnerability management, and mitigation. The Company's cybersecurity team has processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees, mechanisms to detect and monitor unusual network and endpoint activity, integrated threat intelligence and containment and incident response tools. The cybersecurity team also leverages multiple third-party security programs for full-time monitoring of security stacks and on-demand support to act as force multipliers in the event of severe or critical security events.

companyName: FARMER BROTHERS CO

ticker: FARM


text: In conjunction with EBM, Inc., we employ best in class Endpoint Detection and Response with 24/7 SOC at the Endpoints. We also utilize MFA and Geolocation enforcement where available. We continuously monitor and maintain our network infrastructure including consistent vulnerability monitoring and remediation. We also engage in quarterly phishing campaigns as well as cybersecurity awareness training to our end users to keep them vigilant in being able to detect threats.

companyName: Azitra, Inc.

ticker: AZTR


text: We leverage the support of third-party information technology and security providers, including for periodic security testing, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors. We have also engaged a third-party with specialized expertise in cybersecurity to conduct an audit, which resulted in no notable findings, and reported the results to the Audit Committee.

companyName: Q32 Bio Inc.

ticker: QTTB