text: The Corporation's information security program is led by the Chief Technology Officer in conjunction with the Chief Risk Office and the Executive Enterprise Risk Management Committee. The Board Enterprise Risk Management Committee is responsible for oversight of the Corporation's cybersecurity and information security program and regularly reviews and evaluates information security and cybersecurity risks provided by management.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts in evaluating and testing our risk management systems. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with the third-party includes threat assessments and consultation on security enhancements. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates.

companyName: SOCKET MOBILE, INC.

ticker: SCKT

secItem: Item 1C


text: In 2024, we did not identify and were not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks, systems or data or those of our suppliers or vendors may have a material adverse effect on our operations or results of operations" of Item 1A.

companyName: AT&T INC.

ticker: T


text: The Chief Information Officer ("CIO") holds primary oversight responsibility for the team managing the development, operation, and maintenance of our information security program. This team also has responsibility to maintain and enhance the Company's written cyber security incident response plan, which identifies incident severity classifications and serves as a trigger for escalation for the response team.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Security Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Security Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: The Information Technology Risk Management Committee is chaired by the Chief Technology Officer and comprised of IT management and other key stakeholders from across the Bank. They are responsible for identifying, measuring, monitoring, and controlling risk generated within IT, including cybersecurity risk. This committee reviews and updates risk assessments as necessary and monitors activity through risk reports and dashboards. A cybersecurity dashboard, which includes a summary of key risk metrics, is reviewed and monitored by the IT Risk Management. The Chief Technology Officer and Information Security Officer provide quarterly reports to the Board Risk Committee.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We are also subject to mandatory and enforceable regulatory standards for critical infrastructure protection, which include cybersecurity-related standards. We are subject to periodic audits by Texas RE of our compliance with critical infrastructure protection standards. In addition, we are required to file an emergency operation plan with the PUCT, including our procedures relating to addressing cyber incidents.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: The Company has defined and maintains cross-functional incident response and recovery plans that will guide the Company's response to a cybersecurity incident. These plans are reviewed by senior management and are evaluated through tabletop exercises on a regular basis.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Our business operations rely on the consistent availability of our communication platforms, enterprise applications, and related systems. We have implemented protocols to ensure the secure collection, storage, and transmission of data and have invested in the development and enhancement of controls designed to prevent, detect, and respond to unauthorized access, computer viruses, malware, data exfiltration, and other threats.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: Our practices include providing ongoing security awareness training for our global workforce, conducting ransomware and phishing simulations, deploying advanced tools for detecting and analyzing anomalous network activities, and implementing robust containment and incident response procedures. We leverage threat intelligence from our security vendors, as well as from trusted sources such as CISA and the FBI, to enhance our defenses and stay ahead of emerging threats. Additionally, we are committed to staying aligned with the latest industry standards and actively participating in industry forums to exchange insights and proactively address evolving cybersecurity challenges.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Cybersecurity risk is managed thru effective inter-department cooperation towards assessing and remediating risks ranging across corporate IT, software development, software quality process, production network architecture and deployment, and data security/privacy.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our strategy includes a formal Incident Response Plan, designed to help the organization prepare for, respond to, and recover from confirmed or suspected cybersecurity or privacy incidents. Further, it evaluates and validates the effectiveness of our incident response capabilities, and allows for improvements as needed.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Our enterprise risk management program, which includes cybersecurity risks that are identified through our cybersecurity risk management program, is designed to identify, report, and manage relevant material risks and opportunities.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: The Company has developed a standards-based information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. The maturity and effectiveness of the security program is reviewed biennially by a reputable third party.


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2025, and through the date of filing of this Form 10-K.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our technology strategy.

companyName: Freedom Holding Corp.

ticker: FRHC


text: The Board is responsible for risk management, with specific oversight of cybersecurity risks being delegated to the Audit Committee. The Audit Committee receives updates from the IT Director at each of its quarterly meetings. These updates encompass an assessment of Tredegar's cybersecurity risk profile, including the efficacy of Tredegar's cybersecurity policies, procedures, strategies, and areas of emerging risk. Additionally, the Board receives annual, but often more frequent, updates on Tredegar's cybersecurity systems.

companyName: TREDEGAR CORP

ticker: TG


text: of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. The Company's Board of Directors as well as its Chief Technology Officer, Chief Information Security Officer, and Chief Financial Officer are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes, and practices for assessing, identifying, managing and mitigating material risks from cybersecurity threats.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: The Company's cybersecurity program is supervised by our Chief Information Security Officer ("CISO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity, strategy, policy, standards, and processes. The CISO provides quarterly updates related to the cybersecurity program, including any notable incidents at regularly scheduled Audit Committee meetings. The CISO updates include details regarding the magnitude, financial impact, and remediation of cybersecurity incidents. Members of our Board of Directors and senior Company executives participate in annual tabletop exercises that focus on testing response plans to ransomware, cloud security, payroll disruption, and other incidents. In addition, in order to deploy a consistent cybersecurity framework, and to manage the risk of social engineering, software downloads, and phishing, we educate employees globally through ongoing security awareness training.

companyName: Dayforce, Inc.

ticker: DAY


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CIO and our CISO. Our CIO and our CISO have over 30 years and 25 years, respectively, of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and implementing business continuity planning and incident response plans. Our CIO and CISO each hold several degrees and certifications relevant to their roles. Our CIO and our CISO are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, oversight of the entire IT function, including at Fortive Corporation and the IT leaders at our operating companies.

companyName: Fortive Corp

ticker: FTV


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Governance Related to Cybersecurity Risks

companyName: Eightco Holdings Inc.

ticker: ORBS


text: Board Governance and Management As described above, our CDIO leads management's assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance. The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Enterprise Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters. Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 20 plus years of IT and relevant cybersecurity experience.

companyName: Cencora, Inc.

ticker: COR


text: Our Cybersecurity Group oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. Our Director of IT Infrastructure, who has extensive cybersecurity knowledge, training and skills gained from over 30 years of work experience on cybersecurity and from technology leadership roles in the energy industry, heads the Cybersecurity Group responsible for implementing and maintaining our cybersecurity and data protection practices. The Director of IT Infrastructure reports directly to our Chief Financial Officer.

companyName: TransMontaigne Partners LLC


text: The ISSC consistently collaborates with third-party service providers to support and maintain a robust information security program. These service providers assist in responding to cybersecurity risks by providing comprehensive threat detection, monitoring and response services. The information security program is designed to provide effective processes, procedures, and internal controls, including monitoring cybersecurity threats through endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties evaluate the Company's cyber readiness and resilience through ongoing testing and audits. We adapt our cybersecurity policies, standards, processes, and practices accordingly based on the insights provided by these reviews.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: Xerox Holdings' Cybersecurity organization is a global organization and is dedicated to protecting its infrastructure, information, and digital assets. It is responsible for establishing appropriate security policies, safeguards and controls to prevent, detect and respond to cyber threats, meet regulatory and compliance requirements, secure Xerox Holdings' intellectual property, products and services, and supply chain in collaboration with business, product, and IT partners. The information security organization is led by the Chief Information Security Officer (CISO) who reports to the Chief Administrative Officer and Global Head of Operations. With more than twenty years of experience in security, the CISO began his security career serving in the United States Marine Corps (USMC), leading physical security and executive protection for Marine One. He subsequently led cybersecurity programs for U.S. Cyber Command and the Pentagon, advised Fortune 500 clients on cybersecurity and crisis response matters as an Advisory Director at PwC, and has held positions as CISO or Deputy CISO for public and private companies. The CISO is currently pursuing a Master of Business Administration (MBA), and is a Certified Information Systems Xerox 2024 Annual Report 25

companyName: XEROX CORP


text: Our management is actively engaged in overseeing our third-party service providers. Our Enterprise Third Party Risk Management (TPRM) Policy establishes requirements and practices used to oversee and manage the activities of third parties with whom we have a relationship, under which we identify, measure, monitor, and manage third-party risk (including information cybersecurity risks) in alignment with our strategic objectives and in compliance with applicable law. Any identified threats, vulnerabilities, or cybersecurity incidents are addressed as appropriate through our CTO, CISO and IPM.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Invest Acquisition Corp


text: –a security team, led by our Vice President of IT (VP of IT), principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) responses to cybersecurity incidents;

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Our Board of Directors ("Board") has overall oversight responsibility for our enterprise risk management framework and cybersecurity risk management. The Board is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management, including the Vice President of Information Technology with support from our Information Technology Council, updates the Board on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. Our Vice President of Information Technology, who has more than 30-years of global information technology, systems, and IT audit experience, is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis; establishing processes to ensure that such potential cybersecurity risk exposures are monitored; putting in place appropriate mitigation measures; and maintaining cybersecurity programs. The Vice President of Technology oversees a cybersecurity team that includes experienced cybersecurity professionals with credentials such as CISSP (Certified Information Systems Security Professional), CompTIA Security+, and ISO 27001. Our Vice President of Information Technology receives reports from our Information Technology Council and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our Information Technology Council includes experienced information systems security professionals and information security managers. Our Information Technology Council, which is composed of technology leaders from each of our business units, collaborates on a cross-functional basis to identify practices that can counter threats and to monitor our cybersecurity programs and our cybersecurity incident response plans.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: We are a blank check company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Legato Merger Corp. III

ticker: LEGT


text: As a trusted advisor to our clients and a regulated financial services firm, information and cybersecurity are critical to our operations and reputation. Our management team takes an active role in identifying, assessing, monitoring and managing material risks from information and cybersecurity threats. Management's assessment of information and cybersecurity threats is incorporated into our enterprise risk management processes, which include assessing inherent risks posed by the internal operating environment and external factors, assessing the adequacy and design of controls, testing controls, determining residual risk and comparing it to risk appetite thresholds, and taking steps to further mitigate risks as needed. Our board of directors is actively engaged in the oversight of cybersecurity and information technology risks, with primary oversight responsibility delegated to the audit committee of the board of directors. The audit committee is composed of board members with the appropriate expertise, including risk management, cybersecurity and finance, to oversee these risks as well as management's cybersecurity processes and protocols.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board of Directors' oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Digital and Information Officer, or CDIO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to protect, detect, monitor, mitigate and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our audit committee or board of directors to discuss if deemed necessary or appropriate. We also alert employees to significant new cybersecurity issues on a regular basis.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: The Company's Vendor Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Our governance and oversight framework for cybersecurity risks operates at multiple levels within the organization. The Board of Directors has final oversight responsibility for cybersecurity-related matters and receives regular updates from the Chief Information Officer and senior management on the status of the cybersecurity program, vulnerability assessments, strategic initiatives, and any significant incident response activities.

companyName: HEICO CORP

ticker: HEI


text: Certain members of our management team are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Financial Officer and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: IT management provides regular reports to the Corporation's senior management throughout the year, and to the Audit Committee or the Board of Directors, as appropriate, in its annual cybersecurity review. Such reports typically address, among other things, the Corporation's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans as well as the evolving cybersecurity threat landscape.

companyName: EXXON MOBIL CORP

ticker: XOM


text: The board of directors is responsible for the oversight of cybersecurity risk management and is composed of members with expertise in risk management, technology, and finance, thereby equipping them to manage and prevent cybersecurity risks effectively.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks, when applicable, from cybersecurity threats by the Company's Chief Executive Officer. Updates on cybersecurity matters, including material risks and threats, are provided to the Company's audit committee, and the audit committee provides updates to the Company's board of directors at regular board meetings.

companyName: MDWerks, Inc.

ticker: MDWK


text: The Sponsor maintains system access rights and controls for the Trust including: restricting Supervised Persons' (a "Supervised Person" is each employee, officer, member, and other persons who are subject to the Sponsor's supervision and control) network resources access to the systems which are necessary for their business functions, secure remote access protocols; The Sponsor maintains its systems carrying Trust data with appropriate updates and virus protections;

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics. For example, our Board recently established and authorized a Task Force on Technology (the "Task Force") to assist and support the Board in a strategic review of the role of technology in our operations, our current and future investments in technology resources, and the current board oversight of risk, governance, and controls surrounding technology and cybersecurity. The Task Force is comprised of members of the Board, working closely with management, including the CIOO.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: In addition, a periodic cybersecurity risk assessment is completed with an external third party to provide us with a more complete view of our cybersecurity risk. We retain a prominent cybersecurity consulting firm to assist with, and advise on, our cybersecurity and incident response program. We engage on a quarterly basis with our internal auditors on matters regarding cybersecurity and maintain a robust control environment, in compliance with the Sarbanes-Oxley Act of 2002, as amended, that includes controls to protect the confidentiality, integrity and availability our data.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: New Mountain Capital uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, New Mountain Capital uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, New Mountain Capital also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Investment Adviser, or our Administrator are detected. New Mountain Capital also requires that all employees, including employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.employees of the Investment Adviser and Administrator, complete interactive security awareness training on an annual basis.

companyName: NMF SLF I, Inc.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: proactively review systems and applications, audit against applicable data security policies, perform penetration testing to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: TrueCar, Inc.


text: The governance of cybersecurity risks will be a critical function of our Board, which will have a key role in the oversight of cybersecurity and related technology risks. The Board will be tasked with monitoring the effectiveness of our cybersecurity risk management program, once adopted.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: Cybersecurity awareness among our employees is promoted with regular training and awareness programs. Employees receive training on recognizing and reporting potential cybersecurity threats, best practices for data protection, and adhering to cybersecurity policies and procedures. Additionally, periodic simulated phishing exercises are conducted to enhance employee readiness in identifying and mitigating phishing attacks.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: To date, the Company has been subject to cyber related incidents, as previously disclosed in the Company's Quarterly Report for the quarters ended June 30, 2023 and September 30, 2023 and within this Annual Report. Since the identification of the incident, we have implemented additional safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company.

companyName: SMITH MIDLAND CORP

ticker: SMID


text: 2.The IS team works with the executive team to identify, assess, verify, and classify incidents to determine affected stakeholders and appropriate parties for contact;

companyName: Pennant Group, Inc.

ticker: PNTG


text: Our cybersecurity risk management strategy forms part of our overall enterprise risk management program. We conduct regular risk assessments designed to identify cybersecurity threats and other risks to the company. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence, and any potential damage that could result from such risks. We also evaluate the sufficiency of our existing internal controls and monitor the effectiveness of such safeguards. In response, we adjust our processes and controls as necessary.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: As a natural gas local distribution company, Southwest's objective is to comply with the U.S. Department of Homeland Security Transportation Security Administration ("TSA") security directives for our gas monitoring and control systems. Pursuant to these directives, Southwest engages outside consultants to regularly review our technical architecture and alignment with the TSA security directives. In addition to complying with these regulations, Southwest takes a quantitative approach to cybersecurity risk to identify areas for future cybersecurity investment and periodically engages experts to attempt to infiltrate our information systems to further strengthen our security posture. We invest in a range of cybersecurity technologies within the perimeter, network, and endpoints, creating a defense-in-depth architecture designed for prevention and response to cybersecurity events and to help minimize exposure to risks.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: the regular (less than 30 days) installation by our third-party information security provider of critical and high severity patches across our systems; training for our employees on cybersecurity awareness;

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Our cybersecurity program includes tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.

companyName: Anywhere Real Estate Group LLC


text: The key components of our cybersecurity program will include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, product, services, and overall IT infrastructure;

companyName: Onconetix, Inc.

ticker: ONCO


text: Processes for Informing the Board: The audit committee is regularly informed about cybersecurity risks through quarterly briefings from the President and COO. These briefings include risk assessment reports, incident response updates, changes to the cybersecurity landscape, and other relevant information. In the case of a cybersecurity incident that meets reporting thresholds, the audit committee will be promptly notified and will receive continual updates until the situation is remedied.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our advisor has formed a Cyber Governance Committee ("CGC"), among its members include our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer and our advisor's Chief Financial Officer (also our Chief Financial Officer) material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.

companyName: KBS Growth & Income REIT, Inc.


text: One of the key functions of our board of directors (our "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable. Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Network Security.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: We are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operation and reputation. We recognize the importance of developing, implementing, and maintaining comprehensive cybersecurity measures as part of our larger risk management program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team works closely with our Information Technology and Information Security ("InfoSec") departments to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our information security program incorporates data encryption and access control, single sign-on and multi-factor authentication, vulnerability management, and malware protection for both laptops and servers. We align with industry standards and frameworks, and we maintain FedRAMP Moderate authorization, an ISO 27001 certificate, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. There can be no guarantee that, in every instance, our policies and procedures will be properly followed or that those policies and procedures will prevent malicious or unauthorized access to our information systems.

companyName: WORKIVA INC

ticker: WK


text: The Cybersecurity Committee will provide periodic updates to the Company's Audit Committee regarding its activities, and in the event of a material cybersecurity or privacy incident involving the Company, on the status of the Company's cybersecurity and data protection response and disclosures. Through these briefings, the Cybersecurity Committee will periodically provide the Audit Committee with appropriate information, as applicable, on the status of--(1) the Company's cybersecurity and data protection program strategies, projects, initiatives, opportunities, developments and any material changes in the foregoing; (2) budgets and resources; (3) information security or privacy assessments, audits and tests conducted by the Company or third parties; (4) the Company's escalation protocols with respect to prompt reporting of cybersecurity incidents to management, the Audit Committee and the Board; and (5) material cybersecurity and privacy incidents, risks, issues and legal developments, as well as the remediation or risk mitigation measures undertaken to address such issues. Also, any cybersecurity incident requiring public disclosure on a Current Report on Form 8-K or other applicable public filings or disclosures will be reported to the Audit Committee prior to any such disclosure. As appropriate, the briefings also will present management's recommendations for changes to the Company's cybersecurity and data protection practices.

companyName: Cano Health, Inc.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third-party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table-top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third-party vendor to undertake annual penetration and vulnerability testing, with the results reported to the ITC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2024.

companyName: GERON CORP

ticker: GERN


text: Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions, and other events of varying degrees. To date, we have not experienced a material security breach, nor are we aware of any third-party outside service providers that have experienced a cybersecurity breach. As a result, we have not incurred any significant expenses from information security breaches or any penalties or settlements related to the same.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: Management provided by Ashford Inc. is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer of Ashford Inc. and the Chief Technology Officer for Remington Hospitality. A Cyber Incident Response Team comprised of Ashford Inc. and Remington Hospitality employees meets bi-weekly to review incidents that have occurred and/or impacted the Company's electronic assets. The Chief Technology Officer of Remington Hospitality reviews weekly reports that contain an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Chief Technology Officer provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the board of directors is then briefed each quarter on the occurrence of any cybersecurity incidents. The board of directors will also be provided an overview of the information security program on an annual basis, including updates on Remington Hospitality's IT team, IT training, implementation, IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: The Company considers cybersecurity to be an important part of its overall business strategy and risk management. UTMD continuously monitors its information systems to assess, identify and manage risks from both inside and outside forces. Functional modules are fully-integrated, which provides for transaction checks and balances. Software systems have been validated for effectiveness of intended uses. Policies and procedures have been implemented which all employees acknowledge in writing, and agree to follow as a condition of employment. Access is documented and controlled by business function. Regular employee user training is conducted to promote awareness of outside threats and the importance of following procedures.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: During the weekend of September 23, 2023, the Company experienced a cybersecurity incident impacting its internal IT infrastructure and applications. The incident caused disruptions and limitation of access to portions of the Company's business applications supporting aspects of the Company's operations and corporate functions. The impact of the incident included lost and deferred revenues, primarily attributable to order processing and logistics disruptions and delays, and expenses associated with the response to, and remediation of, the incident. Further, the cybersecurity incident caused disruptions to certain of the Company's billing systems, which negatively impacted cash provided from continuing operations primarily during the first quarter of fiscal 2024. The overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for the full year fiscal 2024.

companyName: Johnson Controls International plc

ticker: JCI


text: The AGM board of directors' oversight of cybersecurity risk management is supported by the audit committee of the AGM board of directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM board of directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, the AGM's Chief Security Officer ("CSO"), CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM board of directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Our executive team, including our Senior Vice President, Chief Operating Officer and Chief Financial Officer and our Senior Vice President, Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The executive team has primary responsibility for our overall cybersecurity risk management program. Our Senior Vice President, Chief Operating Officer and Chief Financial Officer supervises our Vice President, Information and Technology, who leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare our company and our internal cybersecurity personnel and retained external cybersecurity advisors to address cybersecurity risks. Our Vice President, Information & Technology has over 25 years of experience managing IT and cybersecurity programs, including two decades of experience implementing endpoint security, network security, incident response plans and end user training programs. Our internal cybersecurity personnel collectively have experience in cybersecurity, information security, data protection, privacy, regulatory compliance and risk management within complex and international business verticals, such as pharmaceuticals/biotechnology, technology, telecommunications and financial services, and hold several related third-party certifications related to information systems management and security.

companyName: Mersana Therapeutics, Inc.


text: Third Parties in Risk Management engage a range of external experts, including consultants and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These engagements are intended to give us access to specialized knowledge and insights to inform our cybersecurity strategies and processes, including industry-standard control frameworks and applicable regulations, laws, and standards.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: The Company has developed a matrix to assist in determining if a cybersecurity incident is significant. The Information Security Director, with the help of the CIRT, determines whether an incident should be escalated to executive management, including to the Chief Executive Officer, the Chief Financial Officer and the General Counsel, based on its significance. Once escalated, executive management determines the appropriate incident handling strategy, with input from the Information Security Director, including whether the incident warrants immediate notification to the Audit Committee of the Board of Directors. After determining the incident handling approach, the CIC regularly updates executive management on incident response progress to ensure it is aware of the business risks posed by the incident until the incident is resolved.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Senior leadership regularly provides updates to the Audit Committee of the Board of Directors on the status and outcomes of internal audits evaluating our cybersecurity systems, controls, and processes. Our program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which serves as a valuable resource in helping us identify, assess, and manage cybersecurity risks aligned with our business needs. This does not imply that we meet any particular standards, specifications or requirements, only that we use NIST as a guide.

companyName: Oklo Inc.

ticker: OKLO


text: The Company has implemented data security measures and has not, to date, been subject to any material data security breaches, data loss or cyber-attacks. However, despite the Company's efforts to protect sensitive information and confidential and personal data, comply with applicable laws, rules and regulations and implement data security measures, the Company's facilities and systems may be vulnerable to security breaches and other data loss, including cyber-attacks. In addition, it is not possible to predict the impact on the Company's business of the future loss, alteration or misappropriation of information in the Company's possession related to the Company and EEI's employees, former employees, or others. This could lead to negative publicity, legal claims, theft, modification or destruction of proprietary information or key information, damage to or inaccessibility of critical systems, operational disruptions and other significant costs, which could have an adverse impact on the Company's revenues and earnings.

companyName: EVERFLOW EASTERN PARTNERS LP


text: Our Director of Information Technology, who reports to our principal financial officer, leads the operational oversight of Company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess, manage, and help prepare us and our directors and employees to address, cybersecurity risks. Specific cybersecurity related responsibilities of the Director of Information Technology include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Director of Information Technology has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: We maintain processes designed to evaluate the security practices and controls of our critical third-party vendors that have access to our confidential information, which includes security questionnaires and third-party information security assessments, as applicable.

companyName: AlTi Global, Inc.

ticker: ALTI


text: The management of our cybersecurity risks is led by the CIO and the executive team who bring over 35 years of combined experience in cybersecurity, IT, and risk management. This team is responsible for the overall cybersecurity risk management program, collaborating with internal teams, external consultants, and cross-functional divisions. Their efforts are supported by threat intelligence from various sources, and they regularly benchmark our security practices against the NIST CSF.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: Any failure to prevent or mitigate security breaches, cyber-attacks or other unauthorized access to our systems or disclosure of our customers' data, including their personal information, could result in loss or misuse of such data, interruptions to our service system, diminished customer experience, loss of customer confidence and trust, impairment of our technology infrastructure, and harm our reputation and business, resulting in significant legal and financial exposure and potential lawsuits and could cause the value of such securities to significantly decline or be worthless. In addition, any violation of the provisions and requirements under relevant laws and regulations with respect to cyber security, data security and personal information protection may subject us to rectifications, warnings, fines, confiscation of illegal gains, suspension of the related business, revocation of licenses, cancellation of qualifications being entered into the relevant credit record or even criminal liabilities.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We track cybersecurity risk as an enterprise risk through our enterprise-wide risk management ("ERM") framework. The Board of Directors is actively involved in oversight of our ERM framework and receives regular reports on risks, including cybersecurity risks. We engage third parties to conduct threat assessments, information system penetration tests, and simulation exercises to validate and further mature our cybersecurity program, the results of which are reported to the Executive Leadership Team, including CTO, and the Board of Directors. We maintain cybersecurity insurance coverage to help mitigate the financial impact of a cybersecurity incident.

companyName: nVent Electric plc

ticker: NVT


text: Our cybersecurity incident response process involves a multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders, including if appropriate the audit committee and the board, and keeping them informed and involved as appropriate. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that has had a material impact on our business or operations, we have experienced incidents that did not have a material impact on our business or operations, and there can be no guarantee that we will not experience an incident that results in a material impact to our business or operations in the future. In addition, cybersecurity threats are constantly evolving and increasing in sophistication, which increases the difficulty of successfully defending against them or implementing adequate preventative measures.

companyName: Perception Capital Corp. IV


text: As discussed above in "Cybersecurity Risk Management," the RRG shares the results of its independent internal audits of security activities at Key and the effectiveness of the IS Program with the line of business management, Key's Operational and Compliance Risk Management Groups, the Board's Audit Committee, and banking regulators. Any identified gaps are risk rated, issued a due date for remediation, and tracked through completion of remediation. Remediation is then verified by the RRG.

companyName: KEYCORP /NEW/

ticker: KEY


text: We rely on certain external service providers to assist in the management of the day-to-day operation of our business, operate elements of our manufacturing facilities, manage relationships with our employees, customers, and suppliers, fulfill customer orders, and maintain our financial, accounting, or other business records. The Information Security team maintains a third-party security program to identify, prioritize, assess, mitigate, and remediate our third-party risks; however, we also rely on our third-party vendors, suppliers, and other business partners to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. Cybersecurity risks are assessed when selecting our third-party service providers and reassessed periodically.

companyName: OLIN Corp

ticker: OLN


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including, among other things. cybersecurity consultants, cybersecurity software providers, penetration testing firms and other professional services firms.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: We emphasize continuous training for our staff to enhance their ability to identify and respond to cybersecurity threats. To support this effort, we invest in cybersecurity technology and talent. Additionally, we conduct rigorous vendor assessments and require specific security standards for third-party providers. Our comprehensive policies and procedures are designed to safeguard the integrity and security of information collected by us and our service providers. We have also implemented security measures to prevent unauthorized access to personal data and mitigate potential incidents. Furthermore, we learn from any past incidents and near misses to strengthen our resilience.

companyName: NBT BANCORP INC

ticker: NBTB


text: We operate in a highly regulated industry. Federal, state and international laws and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information. Our success depends on maintaining a high level of trust among our stakeholders, including our consumers, clients, business partners, providers, regulators and associates. Failure to effectively secure, maintain and upgrade our information systems, or the availability and integrity of our data, could adversely affect our business, including our business strategy, cash flows, financial condition and results of operations.

companyName: Elevance Health, Inc.

ticker: ELV


text: Our management team, including our Chief Executive Officer, the VP R&D and Data Protection Officer of Cortex, and our external advisors, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Viewbix Inc.

ticker: VBIX


text: While cybersecurity risk can never be eliminated entirely, we devote significant resources to our cybersecurity program that we believe is reasonably designed to mitigate our cybersecurity and information technology ("IT") risks—which include, among others, unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. Cybersecurity risk management processes have been integrated into the Company's overall risk management system, including our ERM process. Threats to our cyber/digital landscape are regularly identified and then assessed in terms of their potential business impact. Mitigation strategies are developed based on our assessment of the potential business impact (both quantitatively and reputationally) of the threat. Because a cybersecurity threat can have implications beyond IT, the Company draws on cross-functional expertise to determine the potential business impact and proportional mitigation efforts or solutions. This expertise may involve third-party resources with functional expertise related to the specific threat or business impact. As part of our risk management profile, we regularly review available cybersecurity data regarding our business partners (suppliers, dealers, third-party service providers and others) and regularly engage with them on risk mitigation efforts.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Our management team, including our Director of Information Technology, has a combined 35 years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The experience of our management team encompasses leadership, development, and support of cybersecurity strategies, along with the implementation of policies and procedures. Furthermore, they possess a track record of proactively monitoring cybersecurity threats and promptly responding to and remediating cyber attacks. Their adeptness in executing security controls has consistently yielded clean audit observations, showcasing their effectiveness in safeguarding against potential risks.

companyName: CG Oncology, Inc.

ticker: CGON


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: maintain a risk register and risk assessment process based on The National Institute of Standards and Technology ("NIST") Cybersecurity Framework; use various third-party software testing products and services designed to test and assess the security of our software; closely monitor emerging data protection laws and implement changes to our processes designed to comply with such laws; undertake an annual review of our policies and statements related to cybersecurity;

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats.

companyName: JBG SMITH Properties

ticker: JBGS


text: A "cybersecurity incident" means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a company's information systems that jeopardizes the confidentiality, integrity or availability of a company's information systems or any information residing therein.

companyName: Emeren Group Ltd


text: Our management team, including our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO leads a team that has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our CTO has more than 12 years of experience in cybersecurity, software, and IT in various technology-related businesses, including some oversight over security and integrity of systems and operations. In addition, our CTO leads our Security team, who have more than 16 years of experience in these fields.

companyName: Wag! Group Co.


text: We have a cybersecurity incident response plan (CIRP) that we review on at least an annual basis and update as business needs and the security landscapes change and as required. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to our systems and networks, minimizing the impact on our stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management and the Board of Directors, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises on at least an annual basis to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Cohen & Steers has implemented and maintains various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: The Trust does not have any material internal operations of its own that face material cybersecurity threats and is not a regulated financial institution subject to mandatory cybersecurity compliance under New York law (including, without limitation, the New York Code, Rules and Regulations), and therefore has not adopted any cybersecurity risk management program or formal processes for assessing or monitoring cybersecurity risk. However, the Trust does depend on the digital technologies of the Corporate Trustee and third parties, including EMI, Sony/ATV and their respective affiliates' information systems, infrastructure and cloud applications and services. Any sophisticated and deliberate attacks on, or security breaches in, the systems, infrastructure or cloud that benefit the Trust, including those of the Corporate Trustee and third parties, could lead to corruption, misappropriation or miscalculation of the gross royalty income arising from the Catalogue (or calculation of the Contingent Portion related thereto) and/or the Trust's assets, proprietary information and sensitive or confidential data. Because of the Trust's reliance on the technologies of the Corporate Trustee and third parties including EMI, Sony/ATV, their respective affiliates, the Trust also depends upon the personnel and the processes of such parties to protect against cybersecurity threats arising from their own operations in the ordinary course of their respective businesses. The Trust does not employ any operating personnel and has not contracted for the development of processes of its own for the purpose of data security protections and as such may not adequately protect against, or investigate and/or remediate any vulnerability to, cyber incidents. To the best knowledge of the Trustees, as of December 31, 2023, risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Trust, but it is possible that any of these occurrences, or a combination of them, could have material adverse consequences on the Trust, including its results of operations or financial condition.

companyName: MILLS MUSIC TRUST

ticker: MMTRS


text: We have a multilayered framework for detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology ("IT") systems from cybersecurity threats, we use various tools that help prevent, detect, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would assess the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage technical safeguards intended to protect the Company's information systems from cybersecurity threats, including firewalls, threat monitoring, intrusion prevention and detection systems, anti-malware, access controls, privilege management, asset and endpoint management, and ongoing system security assessments. We oversee third -party service providers by conducting vendor diligence and reviews on a regular basis. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular network scans, system audits, and intelligence feeds. The results of these assessments are used to improve our security posture through remediation efforts.

companyName: TaoWeave, Inc.

ticker: TWAV


text: The Chief Information Security Officer leads the Company's Incident Advisory Committee ("IAC"), which is notified in the event of high or medium severity incidents. The IAC includes representatives from information technology, legal, and often the impacted business unit. The Incident Response Team ("IRT") consists of the IAC and a larger group of managers that is typically notified of more significant incidents. The IRT reports findings to management and the Board as necessary. Each IRT member has specific responsibilities related to his or her function at the Company. On a semi-annual basis, the IRT and management undertake facilitator-led trainings and simulations of information security incidents.

companyName: Primerica, Inc.

ticker: PRI


text: The Company takes steps to manage cybersecurity risks by identifying, assessing, and addressing potential threats to our data and systems, ensuring our security measures are effective. We continuously monitor for cybersecurity risks using automated tools, test for potential threats, and maintain standards, policies, and procedures to guide our security practices. We use a variety of security tools across our systems, require multifactor authentication for access to critical systems, and enforce access control policies to help protect the data within those systems.

companyName: Solidion Technology Inc.

ticker: STI


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional discussion of our cybersecurity-related risks, see Part I, Item 1A, "Risk Factors."

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: We recognize the importance of maintaining the safety and security of our people, systems, and data and have a holistic process, supported by our management and Board of Directors, for overseeing and managing cybersecurity and related risks. As part of AES, we are also supported by AES' cyber risk management program.

companyName: IPALCO ENTERPRISES, INC.


text: Our internal auditor performs certain procedures to test the integrity and functionality of our IT systems (which includes a high-level review of our cybersecurity defenses). In addition, we have retained a third-party cybersecurity consulting firm that (i) advises us as to cybersecurity matters (including prevailing cybersecurity threats), (ii) performs, on a periodic basis, assessments of our cybersecurity defenses and (iii) on a continuous basis, monitors our IT systems for cybersecurity threats and intrusions.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: As appropriate, we assess our internal controls, including controls around our information technology systems and their impact on our financial statements or systems, through either independent audits or internal assessments with the assistance of third party resources.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: (iii) Whether the registrant has processes to oversee and" identify such risks from cybersecurity threats associated with its use of any third-party service provider.

companyName: Energy & Water Development Corp

ticker: EAWD


text: Dominion Energy's Board of Directors, including its finance and risk oversight committee, provides oversight of risks from cybersecurity threats to all Dominion Energy operations, including DESC. Dominion Energy's Board of Directors as well as its finance and risk oversight committee receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity and chief information officer. These presentations and reports address a broad range of topics, including Dominion Energy's cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2023 of its second practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including an assessment by an independent consulting firm of management's response in a ransomware tabletop drill.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: All monitoring efforts are expected to communicate directly with the Bank through the IT department. Staff has adequate experience and subject matter knowledge to address or elevate issues, and is entrusted with making final determinations of risk and threats, and escalating issues through management or to third-parties. Where appropriate, the Bank will disseminate information to organizations such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC") or Cybersecurity & Infrastructure Security Agency ("CISA") and other similar incident management user groups.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Employees receive regular virtual and in-person security awareness training through simulated tests, company communications, and in-person training. We also maintain a vendor management program to identify and assess risks of our third-party service providers.

companyName: Bank7 Corp.

ticker: BSVN


text: The Audit Committee of our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reported to our Chief Financial Officer during 2024. Our Vice President of Information Technology and Security provides updates on cybersecurity threats and risks to the Audit Committee of our Board of Directors throughout the year. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2024 as part of their oversight of our enterprise risk management process.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Mr. Fellon is supported by our Director of Cybersecurity and Compliance, and his team. Collectively our team has certifications from various organizations such as American Society for Industrial Security, AXELOS, Cloud Security Alliance, Information Systems Audit and Control Association, International Information System Security Certification Consortium and SANS Institute.

companyName: Northwest Natural Holding Co

ticker: NWN


text: As part of our overall enterprise risk management program, we prioritize the identification and management of cybersecurity risk at several levels. Our Board of Directors has overall oversight responsibility for our risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Jingbo Technology, Inc.

ticker: SVMB


text: Third Party Risk Management. We maintain a process to identify and evaluate cybersecurity risks and incidents related to key third-party service providers. We assess key third-party service providers' information security controls through an established due diligence process. We also require contracts with such service providers to maintain certain security controls to safeguard our data, and to notify the Company of cybersecurity incidents experienced by the service providers that affect our data.

companyName: PACIFIC PREMIER BANCORP INC


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • regular, mandatory cybersecurity training programs for relevant employees; • comparing our processes to standards set by the International Organization for Standardization ("ISO"); • leveraging the ISO information security incident management model to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • leveraging third-party threat intelligence services designed to model and research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • periodically reviewing our consumer facing policies and statements related to cybersecurity; • conducting regular phishing email simulations for relevant employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) requiring employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident. These approaches vary in maturity across the business and we work to continually improve them.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: We have not experienced a cybersecurity incident which has been determined to be material and the expenses we have incurred from cybersecurity incidents and threats were immaterial, including penalties and settlements, of which there were none.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: Our Chief Financial Officer and our Audit Committee periodically report on cybersecurity risk management to the full board of directors. Our board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including cybersecurity risks.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: This information security program is a key part of our overall risk management system, which is administered by our Information Security Officer . The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our bu sine sses and geographic locations.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: The Audit Committee, as delegated by our Board of Directors, is responsible for reviewing, with management, our internal control systems with respect to information technology security. The Audit Committee Chairperson also participates in our annual overall risk assessment process. In addition to the foregoing, from time to time, the Board of Directors is updated concerning the Company's internal control systems with respect to information technology security.

companyName: FIRST INDUSTRIAL LP


text: The audit committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The audit committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: MetaVia Inc.

ticker: MTVA


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by and incorporates elements of recognized industry standards. Our cybersecurity risk management strategy is guided by both internal cybersecurity risk assessments and third-party information security audits.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Analyzing all third-party vendors for compliance with our internal Info-Sec Policy to assess potential risks associated with their security controls. We generally require third parties to maintain security controls, notify us promptly of any data breach or cybersecurity incident that may impact our data, and provide written assurance of corrective actions; and Engaging and utilizing a comprehensive suite of security solutions, including enterprise mobility management, endpoint protection, secure file transfer, and security information and event management to monitor and actively respond to cybersecurity threats. These solutions work together to secure our endpoints, protect against malware, ensure the safe transfer of files, and provide our cybersecurity team with the functionality to build alerts on specific use cases that are important and unique to our business.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Reporting to Board of Directors Our IT Director, in his capacity, regularly informs the other Risk Management Team members of all aspects related to cybersecurity risks and incidents. This ensures that various levels management are kept abreast of the cybersecurity posture and potential risks facing Energy Recovery, Inc. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that the Audit Committee has comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The DCSI provides periodic reports to our board of directors, as well as our Chief Operating Officer, Chief Executive Officer and other members of our senior management as appropriate, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation, and assessment of our cybersecurity program against programs of other organizations.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: We recognize the importance of effective cybersecurity risk management to our operations and interests. Our cybersecurity program is designed to protect our employees, our customers and our assets through the effective identification and mitigation of cyber risks. The program, led by the Senior Director, Global Information Technology ("IT") Security under the oversight of the Chief Information and Digital Officer ("CIDO"), encompasses a broad range of preventative, detective and responsive measures relevant to our business needs and designed to reduce our specific risks.

companyName: GREIF, INC

ticker: GEF


text: Third parties also play a role in the Company's approach to cybersecurity and its associated risk management framework. HighPeak Energy leverages technological tools and partners with the goal of augmenting and enabling the efforts of its internal cybersecurity team. Separately, management and oversight of the risks from cybersecurity threats associated with our engagement of third-party service providers is included in our internal auditing processes. In connection with and pursuant to the IRP, our incident response team, made up of management, employees and third-party cybersecurity personnel, works collaboratively across HighPeak Energy to carry out a program that has been designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to respond to potential cybersecurity incidents.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Board of Directors is responsible for oversight of cybersecurity risk. Our Chief Financial Officer and Chief Executive Officer are the members of management responsible for managing and assessing our cybersecurity practices and have recently (subsequent to June 30, 2024)

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: Periodically, we engage consultants and other third party service providers in connection with our cybersecurity practices. These service providers assist us in event monitoring, conduct testing and provide feedback on our readiness and compliance, conduct tabletop exercises, and are "on-call" in the event of a significant event. We have implemented a third-party risk management process that we use to evaluate the capabilities and security posture of third-party service providers. As part of that process, we review third-party service providers to ensure that they have implemented appropriate security measures in connection with their work with us. We have not encountered any cybersecurity incident that had a material impact on our operations or financial standing.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Our information security function, which is led by our Head of IT with the support of our IT department, helps to identify, assess and manage our cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center ("SOC") that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with management and externally (e.g., with law enforcement) concerning threats.

companyName: ACELYRIN, Inc.


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology (IT) risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our group Chief Information Security Officer (CISO).

companyName: Shutterstock, Inc.

ticker: SSTK


text: Internal and third-party risks are reviewed, monitored and managed by the Company's IT ISC2, SANS, CompTIA certified security partners and external expert consultants. The Company annually engages third-party experts to assess the effectiveness of system and network security. Periodically, an external independent consultancy team conducts a comprehensive review of the Company's cybersecurity program using the National Institute of Standards and Technology Cybersecurity Framework. Additionally, the Company is assessed annually by an independent third party for compliance with the PCI-DSS standard, for which the Company receives an attestation of compliance.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to our Incident Response Team. The Incident Response Plan is designed to analyze, contain and remediate any cyber incidents that may circumvent existing safeguards. The Incident Response Plan encompasses a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal and external communication and disclosure protocols. We also maintain data backup procedures in the event of a cybersecurity incident. The Incident Response Plan is evaluated at least annually.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Our data breach response plan designates an incident response team comprised of senior leaders within information technology, finance, legal and compliance functions to ensure timely diagnosis and mitigation of cyber events. The incident response team is responsible for determining whether a cybersecurity incident is material and requires current reporting pursuant to SEC Form 8-K Item 1.05 (Material Cybersecurity Incidents). In conducting the assessment, the team considers factors including, but not limited to: the probability of an adverse outcome; the potential significance of loss; the nature and extent of harm to individuals, customers, and vendors; the nature and extent of harm to our competitive position or reputation; and the possibility of litigation or regulatory investigations.

companyName: AtriCure, Inc.

ticker: ATRC


text: In an effort to effectively prevent, detect, and respond to cybersecurity threats, we employ a multi-layered cybersecurity risk management program supervised by Ford's Chief Information Security Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, architecture, and processes. The team provides cybersecurity services for Ford and its affiliates, including Ford Credit. The services provided to Ford Credit and its affiliates are governed by appropriate service agreements with Ford. Local regional teams and designated responsible individuals work with the enterprise-wide team to provide cybersecurity-related services in compliance with local requirements. The team's responsibility includes identifying, considering, and assessing potentially material cybersecurity incidents on an ongoing basis, establishing processes designed to prevent and monitor potential cybersecurity risks, implementing mitigation and remedial measures, and maintaining the cybersecurity program. To do so, the program is informed by and designed to comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The program leverages both internal and external techniques and expertise. Internally, we perform penetration tests, internal tests/code reviews, and Red Team exercises, among other things, to evaluate aspects of our cybersecurity program. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company email and access to Company assets, and regularly circulate security awareness newsletters to employees. Externally, we monitor notifications from the U.S. Computer Emergency Readiness Team ("CERT") and various Information Sharing and Analysis Centers (each an "ISAC"); review customer, media, and third-party cybersecurity reports; and operate a bug bounty program. The cybersecurity program also includes disaster recovery and incident response plans, including a ransomware response plan, which is regularly tested and evaluated in tabletop simulations.

companyName: FORD MOTOR CREDIT CO LLC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: To address cybersecurity risk arising from our relationships with our third-party business partners and service providers, we maintain a third-party risk management program, which takes a risk-based approach and includes elements such as conducting cybersecurity assessments, including cybersecurity-related obligations in agreements, and utilizing external monitoring sources.

companyName: STARBUCKS CORP

ticker: SBUX


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company has implemented a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ