text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business and have, from time to time, experienced external threats seeking to compromise the security, confidentiality, or integrity of our data and systems, including malware and computer virus attacks. As of the date of this report, Davey Tree is not aware of any such risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this Form 10-K.

companyName: DAVEY TREE EXPERT CO


text: We face numerous cybersecurity risks in connection with our business. Such risks can impact our systems, results of operations and financial condition. We have, from time to time, experienced threats to, and breaches of, our data and systems, including malware, ransomware and computer viruses. Our customers, suppliers, subcontractors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. As of the date of this Form 10-K, we have not identified any risks or incidents from cybersecurity threats that have materially affected our business strategy, our results of operations or our financial condition. For more information about the cybersecurity risks we face and the potential impacts on our Company due to a cybersecurity incident, please refer to Item 1A - Risk Factors - "Risks Related to Intellectual Property, Cybersecurity, Information Technology and Data Privacy".

companyName: Qorvo, Inc.

ticker: QRVO

secItem: Item 1C


text: The Company has current insurance coverage for Cybersecurity attacks. This coverage however, may not cover be enough to cover substantial attacks, if they occur. We also cannot be certain that insurance will be available to us with reasonable terms or that any insurer will not deny coverage of a future claim. These risks could substantially increase our operating costs, expose us to fraud or theft, subject us to potential liability and disrupt our business.

companyName: PROCYON CORP


text: Board of Directors The Audit Committee of our Board oversees, among other things, the adequacy and effectiveness of our internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is informed of material risks from cybersecurity threats pursuant to the escalation criteria as set forth in our disclosure controls and procedures. Further, our management team reports on cybersecurity matters, including material risks and threats, to the Audit Committee. Our management team also provides updates annually or more frequently as appropriate to the full Board.

companyName: OLB GROUP, INC.

ticker: OLB


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following:

companyName: KAANAPALI LAND LLC

ticker: KANP


text: The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: Western Uranium & Vanadium Corp.

ticker: WSTRF


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer. These members of management work with our CSI Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our cybersecurity risk management program includes: • dedicated third-party cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents; • cybersecurity regulatory based risk assessments for the Company's systems and applications (where required); • a formal incident response plan, in which incidents are classified based upon the severity, impact, and the potential harm that can be caused by the incident; • annual information security training program for all employees, including phishing awareness training; • working closely with application development and infrastructure & operation teams to embed security considerations into the foundation of technology; • engagement of third-party service providers to conduct assessment of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing; and • a third-party risk assessment process for service providers, suppliers, and vendors.

companyName: ANGIODYNAMICS INC

ticker: ANGO


text: Training and Awareness Our employees undertake cybersecurity and data privacy training during onboarding. The majority of our employees complete annual refresher modules. JFrog also maintains a secure-code training program for developers and quarterly phishing simulation to improve our employees' awareness. Any employee who does not meet our performance expectations in such simulations is required to undergo additional training.

companyName: JFrog Ltd

ticker: FROG


text: 2. Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors (" Board "). The "heat map" includes risks related to cybersecurity threats to L3Harris and our customers, suppliers, vendors, subcontractors or other third parties, and the possibility of a data breach of our confidential, personal and proprietary information through a cybersecurity incident impacting L3Harris or any third party.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Dirctors for approval..

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT I, Inc.


text: Our Board of Directors oversees our risk management process, including with respect to cybersecurity risks, directly and through its committees. The Audit Committee of the Board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports on our enterprise risk profile. Our SVP of Technology, who reports directly to the Chief Financial Officer and has over 25 years of experience managing information technology and cybersecurity matters, is primarily responsible for leading the assessment and management of cybersecurity risks and reports periodically to the Audit Committee on cybersecurity strategy and risks. Our SVP of Technology stays informed about and monitors the prevention, detection, mitigation and remediation of security incidents through various channels, including but not limited to briefings from the operational team members, threat intelligence sources, and alerts from security tools deployed in our IT environment.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: Our CISO has cybersecurity and information technology experience spanning more than 30 years. Prior experience includes serving as the CISO for a multi-national cloud hosting organization serving the legal community and several senior leadership roles in both information technology and information security at a large financial institution, Fortune 500 organizations and a large professional services firm. The CISO holds a degree in Computer Science and maintains appropriate industry certifications.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Risk Factors – Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: Q32 Bio Inc.

ticker: QTTB


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Internally, among other things, we perform penetration tests, internal tests/code reviews, and simulations using cybersecurity professionals to assess vulnerabilities in our information systems and evaluate our cyber defense capabilities. We also perform phishing and social engineering simulations with, and provide cybersecurity training for, personnel with Company e-mail and access to Company assets.

companyName: THOR INDUSTRIES INC

ticker: THO


text: As the leader of our Information Security Team, our Head of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Our enterprise-wide incident management framework addresses risk mitigation activities that stem from incidents including governance structure and organization; risk, incident management and escalation principles; requirements for testing and assessing our processes; and external reporting guidance. We conduct internal assessments and engage external assessors, consultants and auditors to help provide assurance and validation of our security controls, as well as alignment to industry norms.

companyName: Discover Financial Services


text: Our CISO has extensive experience leading global security and IT organizations. He also serves on a public company board as an independent director providing cybersecurity expertise. Team members supporting our program have relevant education and information security experience.

companyName: EQUINIX INC

ticker: EQIX


text: Our Company's Board and the audit committee are jointly responsible for overseeing our overall risk assessment and risk management program as well as our Manager's policies and practices related to our information technology systems, information security and cybersecurity risks. The Company's Board and the audit committee reviews at least annually our enterprise risks and related risk management program. In addition, the Company's Board receives periodic reports from our cybersecurity compliance firm on the primary cybersecurity risks that we and our Manager face and the measures we are taking to mitigate such risks. The chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the Company's Board would also be expected to review the Manager's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.

companyName: SolarWinds Corp


text: Our Audit Committee also receives cybersecurity updates and education on a broad range of topics, including: current cybersecurity landscape trends and emerging threats; the status of cybersecurity initiatives; incident reports and learnings from any material cybersecurity events; and any pertinent cybersecurity regulatory requirements and industry expectations.

companyName: Catalent, Inc.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our Advisor's managed cybersecurity provider, notifications from our Advisor's employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our Advisor's incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event and assessing the severity of the event.

companyName: Net Lease Office Properties

ticker: NLOP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our personnel, including our IT Director, who has 20 years of experience in IT and cybersecurity and is a member of the Information Systems Audit and Control Association (ISACA).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: We proactively monitor networks for suspicious activity and collaborate with governmental and industry partners to stay informed on emerging cybersecurity risks. We also emphasize a culture of vigilance through regular employee training that includes phishing awareness, malware prevention, and reporting protocols.

companyName: HEICO CORP

ticker: HEI


text: Our Board, through the Risk Committee and the Cyber Subcommittee, receives regular updates and reporting from management on cyber and information security matters, including information related to third-party assessments of Valley's information security program, as well as a wide range of topics such as recent developments, evolving standards, Valley's vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Valley's peers and third parties. On an annual basis, the Board and its Risk Committee discuss Valley's approach to cyber and information security risk management. Senior management is briefed by our information security team on cyber and information security matters, preparedness and any incidents requiring the attention of our security incident response team.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: Our Adviser maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Adviser's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. While we have experienced cybersecurity incidents within several of our partnership subsidiaries over the years, these incidents have not been material, as each incident (i) has been isolated to certain segregated IT environments, (ii) has affected relatively few patients and their associated health information, and/or (iii) had a low probability of compromised data. Each of the foregoing cybersecurity incidents has been remediated in the ordinary course of business. However, we could experience a cybersecurity incident that materially affects us in the future. See "Risk Factors" in Item 1A on this Form-10K for additional discussion of cybersecurity risks to our business.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: The Company assesses cybersecurity risks, along with other key risks through its comprehensive Enterprise Risk Management ("ERM") framework. This framework mandates the compilation of a quarterly risk packet, which includes the results of KPIs for the designated risks and determinations as to where the results fell within the predefined tolerance threshold. All key risks are identified at the company level, which is governed by the Risk Committee of the Board and encompasses the broad spectrum of risks, including cybersecurity risks and threats, which are integral to the Company's strategic objectives.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Once a cybersecurity incident is contained our focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have specific recovery time objectives and recovery point objectives in our disaster recovery plan.

companyName: LXP Industrial Trust

ticker: LXP


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our IT Committee and Audit Committee, as well as our Chief Executive Officer, and other members of senior management as appropriate.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: We maintain formal incident response and recovery plans that define our procedures for addressing cybersecurity incidents. These plans are tested, updated, and refined on a regular basis to ensure readiness.

companyName: Pluri Inc.

ticker: PLUR


text: Aquestive's cybersecurity program is built on three key pillars: Governance, Process, Compliance and Audit. While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive's cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness. The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends. The cybersecurity program is executed with the MSSP which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations. The Senior Vice President of Information Technology ("IT Officer"), along with the broader Information Technology function, is responsible for assessing and managing Aquestive's cybersecurity risk and informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Board of Directors reviews and approves an Information Technology and Information Security Risk Appetite Statement which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, vendor management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Members of our executive leadership team, including our CFO and General Counsel, as well as the other members as needed, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: Following these risk assessments, we evaluate whether, and if so, how, to re-design, implement, and maintain reasonable safeguards to minimize identified risks; work to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Technology Officer (CTO), who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Cue Health Inc.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and management in the event of a potential cyber threat or cybersecurity incident. Our Company-wide information security training program includes security awareness training, including regular phishing simulations, cyber wellness training and other targeted training and simulations. These programs provide employees the opportunity to gain an understanding and awareness of the various forms of cybersecurity incidents, including how to identify and report any suspicious activity or threat.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect the confidential information and records of all the Bank's clients in accordance with FDIC regulations. Our Information Security Program, along with its associated policies and guidelines, takes into account FDIC and FFIEC regulations and guidance on sensitive information protection as well as information system security. It is tailored to align with the Company's risk assessment results, and the size, complexity, nature and scope of our activities.

companyName: First Financial Northwest, Inc.


text: Our cybersecurity program is led by our IT department and our Cybersecurity Steering Committee, which consists of IT leadership and certain of our senior management. The members of our IT leadership team have an average of over 25 years of experience in IT operations and over 10 years of experience in IT security, including cybersecurity risk identification and mitigation. Our IT department stays informed of current developments in cybersecurity threats and preventative measures and continuously updates our cybersecurity program based on this knowledge. Additionally, our Cybersecurity Steering Committee meets on a regular basis to assess, identify and manage material cyber risks. We also engage with a range of external specialists, including cybersecurity firms, consultants, and auditors in evaluating and testing our cybersecurity risk management systems, as well as specialized third-party companies that assist in monitoring our information systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. These partnerships enable us to access specialized knowledge and insights which we leverage to continuously improve and modernize our cybersecurity program. We use industry-leading security tools, regularly perform security risk assessments and tool reviews with independent third parties to evaluate program effectiveness, and regularly update our security roadmap. Our IT department monitors industry news and updates to stay aware of the cybersecurity landscape, including incidents or issues that may arise involving our third-party service providers. We perform cybersecurity diligence on certain of our third-party service providers, and for third-party service providers with access to our internal information systems, we require them to review and agree to our relevant cybersecurity policies. Our cybersecurity program is designed to align with the National Institute of Standards and Technology's five-phase Cybersecurity Framework (Identify-Protect-Detect-Respond-Recover). We have integrated cybersecurity risk management into our overall risk management system, ensuring that cybersecurity risks are taken into consideration when managing business objectives and operational needs.

companyName: USA Compression Partners, LP

ticker: USAC


text: Cybersecurity risk is a standing agenda topic at quarterly Audit Committee meetings. Common topics discussed include, but are not limited to, cybersecurity risks, threats and vulnerabilities, and the related monitoring activities, as well as progress made with the Company's information security roadmap. The Audit Committee is apprised of the results of cybersecurity risk assessment and prevention/detection activities (e.g., vulnerability scanning, penetration testing, security awareness training) as well as any changes to cybersecurity laws and regulations, current leading practices, and the changing threat landscape.

companyName: NeueHealth, Inc.

ticker: NEUE


text: At present, we do not employ dedicated cybersecurity personnel due to our limited operational scale and financial resources. We currently conduct due diligence or ongoing reviews of qualified third-party service providers and advisors to support information security and assist management in identifying and addressing potential risks. The Board, at least annually, receives periodic updates from management regarding the effectiveness of these measures and any material developments in our cybersecurity posture.

companyName: SafeSpace Global Corp

ticker: SSGC


text: Our internal Security Operations Center ("SOC") has primary responsibility for assessing, identifying, and managing material risks associated with cybersecurity threats, and provides information security monitoring for both shoreside and shipboard information systems and applications. The SOC is a team comprised of cybersecurity professionals who are responsible for real-time incident response management for our IT infrastructure, which includes our websites, applications, databases, servers, network devices and components and workstations. They are trained and equipped to identify, contain, analyze and investigate any perceived security threats as well as assist internal users with any information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: We engage consultants and auditors in connection with our risk assessment processes. These service providers assist us designing and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to affirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: As part of its broader risk oversight activities, our Board maintains oversight of cybersecurity matters, including managing and assessing risks from cybersecurity threats. The Audit Committee also reviews the adequacy and effectiveness of our information security policies and practices and the internal controls regarding information security risks. The Audit Committee receives updates relating to cybersecurity risk from management, including from our Director of Information Security. The Board also periodically receives reports on risks from cybersecurity threats from our Director of Information Security.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: We have also established an information technology management committee which is led by our SVP, Information Technology, Chief Financial Officer, and Chief Legal Officer. The members of this committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: PROKIDNEY CORP.

ticker: PROK


text: The Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the Chief Information Security Officer. On average, the Corporate Information Security team members have over a decade of cybersecurity experience and hold over 100 industry-leading certifications in cybersecurity. All information security managers have attained a bachelor's degree in a related field of study, with several also having a related master's degree.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our cybersecurity program is implemented and maintained by the Pure Security Office (PSO), a team of security professionals responsible for developing and implementing an information security program designed to protect our assets, including data, networks, applications and people, from cyber threats. The PSO includes individuals with expertise in the following areas and who continue to leverage such expertise at the company in the following manners: • Governance, Risk & Compliance (GRC). Maintaining cybersecurity policies, standards, and processes in place and providing training to our employees on them. • Security Operations. Monitoring our critical systems and assets, and that we are able to identify and respond to security incidents in a timely manner. • Security Engineering & Architecture. Implementing risk-based security controls. • Product Security. Supporting our product teams' security objectives by providing design review, certification management, penetration testing, and consulting services, as well as operating security vulnerability management and reporting dashboard capabilities. • Enterprise resiliency. Developing policies, procedures and practices for critical operations recovery and business continuity in the event of a cybersecurity incident.

companyName: Everpure, Inc.

ticker: PSTG


text: We, our clients and our vendors are regularly the target of attempted cyber-attacks, and we must continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. Such cybersecurity incidents could lead to disruptions in our systems; the unauthorized release or destruction of our or our clients' or other parties' confidential or otherwise protected information; and corruption of data. We regularly re-evaluate, modify and enhance our information security processes as new technologies emerge or new risks are identified. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operating results, cash flows or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk factors - Risks Relating to Our Business - We face risks from cyber-attacks, breaches of digital security, IT system failures and network disruptions that could adversely affect our reputation and our business." for more information about these risks.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: The Company is committed to continuous monitoring and assessment of cyber security controls. The Chief Information Security Officer is responsible for developing, implementing, and enforcing our cyber security program and information security policies to protect the Company's information systems and operational assets. The Chief Information Security Officer position requires at least 15 years of relevant information security experience and relevant security certifications. The Chief Information Security Officer reports directly to the Chief Information Officer and provides regular updates to the executive management team. Our Chief Information Security Officer has over 20 years of relevant experience.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, including potential unauthorized occurrences on or through both, our physical systems and electronic information systems, that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process and store as part of our business, including on behalf of third parties. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: Balance Labs, Inc.

ticker: BLNC


text: The fundamental controls of our cybersecurity program are based around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We engage qualified third-party consultants and advisors to conduct risk and vulnerability assessments to evaluate our systems and to advise us on cybersecurity risk management processes. We maintain a robust vulnerability-management program to evaluate our systems on a monthly basis, and we prioritize remediation efforts based on risk level and criticality of the system or data. We conduct comprehensive penetration testing with external consultants on our enterprise environment and our own products on at least an annual basis.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The Company also has a Risk Committee composed of the following members of the Company's management: • Executive Vice President, Business Services & General Counsel • President, Nucor Business Technology • Vice President and Corporate Controller • Vice President and General Manager, Corporate Legal Affairs • General Manager of Internal Audit • Cybersecurity Director • Manager of External Reporting The Risk Committee is responsible for overseeing the Company's response to cybersecurity incidents. The Risk Committee and the Chair, President, and Chief Executive Officer inform the Audit Committee and the Board of Directors on cybersecurity risks.

companyName: NUCOR CORP

ticker: NUE


text: • Security Awareness and Training Program. Our security training and awareness program is a continuous, dynamic initiative, designed to develop and maintain a security-focused culture and empower our associates to make responsible, secure decisions. As part of this awareness program, we communicate to our associates on a regular basis regarding key security topics and current events, best practices for addressing such cybersecurity threats, and gamification to reinforce effective behaviors. All associates are also required to take an annual, interactive security training program that includes an overview of key security topics, policies and responsibilities.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Our cybersecurity risk management program incorporates a number of components, including, but not limited to, information security policies and operating procedures, periodic information security risk assessments and other vulnerability analyses, and ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented a process to conduct cybersecurity awareness training for employees during onboarding and thereafter.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: The cybersecurity department of the Bank's Information Technology ("IT") department is responsible for the day-to-day operations of our cybersecurity controls and defenses. The department is managed by the Bank's Director of Information Systems and Security, who reports to the Bank's Chief Technology Officer The current Director of Information Systems and Security has more than 24 years of technology and cybersecurity experience. Our Chief Technology Officer periodically reports information about the Company's cybersecurity risks and operational developments to our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: Our cybersecurity risk management and strategy processes, as highlighted above, were led by our IT director. Our IT director had over 20 of experience in managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The IT director monitored the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above. Subsequent to the year-ended December 31, 2023, our IT Director no longer works for the Company, effective February 14, 2024. We have hired a third-party IT service provider to assist with the responsibilities previously conducted by the former IT Director.

companyName: Harbor Custom Development, Inc.


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We will perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.

companyName: Nutex Health Inc.

ticker: NUTX


text: As the head of our cybersecurity team, our CIO reports quarterly on cybersecurity to our Audit Committee, which has primary responsibility for cybersecurity oversight, and also to our full Board and regularly reports to the Chief Executive Officer on such cybersecurity matters. Cybersecurity risk is assessed and tracked as a significant risk faced by the Company and is closely managed along key risk indicators covering security maturity, risk exposure, and security operations. Performance against these indicators is regularly measured and discussed, among other things, in our Board reporting.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: We have implemented a third party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third party vendors. As part of communicating the importance of cybersecurity at an enterprise wide level, we require that all company employees participate in annual cybersecurity training.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Our cybersecurity risk management processes, which are discussed in greater detail above, are led by our CISO, who has over 20 years of work experience relating to cybersecurity, including at major financial institutions and consulting firms, involving the management of information security and the development of cybersecurity strategy, as well as relevant degrees and certifications, including holding a Bachelor of Science degree in Electrical and Computer Engineering. Our CISO oversees a team of approximately 50 professionals charged with the ongoing management of our cybersecurity risk and strategy. These employees monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents, including through the operation of our ITROC, incident response plan and other processes. Our cybersecurity team includes managers that have expertise with cybersecurity, as demonstrated by prior work experience, possession of a cybersecurity certification or degrees or other cybersecurity experience.

companyName: MSCI Inc.

ticker: MSCI


text: The Company conducts risk assessments and compliance audits, both internally and by independent third parties for comparison against industry standards, including the National Institute of Standards and Technology ("NIST") cybersecurity framework and Federal Financial Institution Examination Council ("FFIEC") guidance. Risk assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: We recognize that cybersecurity is integral to safeguarding our operations, intellectual property, patient data and stakeholder trust. Our cybersecurity risk management processes are designed to assess, identify and mitigate material risks from cybersecurity threats. Despite our best efforts to improve cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving and we will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: The JFG Board is responsible for the general oversight of all matters that affect JFG, including the myriad risks impacting it. The JFG Board fulfills its oversight role through the operations of its various committees and receives periodic reports on its committees' activities.

companyName: Senior Credit Investments, LLC


text: Highline partners with cybersecurity companies and organizations, leveraging third-party technology and expertise, including secure cloud storage solutions, firewalls and monitoring software. Highline engages with these partners and their technology to monitor and maintain the performance and effectiveness of its corporate information environment.

companyName: GPB Holdings II, LP


text: Our Director of IT Operations and Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. For example, our Director of IT Operations and Security holds a Master of Science in information security and assurance, holds relevant certifications such as Certified Ethical Hacker, Computer Hacking Forensics Investigator, Security+ and Network+, and has worked for approximately nine years in the field of cybersecurity. Our Principal Accounting Officer is responsible for helping prepare budgets, helping prepare for cybersecurity incidents, and approving certain cybersecurity processes.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: 2023, we stored and processed certain PHI on behalf of customers. From a cybersecurity perspective, this data was stored on secure AWS managed servers in the contiguous United States and encrypted at rest and in transit. End users did not have permission to access PHI unless the end user's account had the proper end user role permissions (ie HCPs or hub service providers). These end user roles were assigned according to the customer's needs to see the information. At all times, such information was segregated so that one customer could not access records containing PHI that were associated with another customer. In late 2023, we discontinued PHI processing; however, certain PHI remains stored on the secure AWS managed servers to the extent information needs to be accessed by a customer.

companyName: OptimizeRx Corp

ticker: OPRX


text: The Company utilizes certain third-party service providers to perform a variety of functions in the operation of its business. TPG has processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: Assessment and Response to Cybersecurity Threats Peoples employs an in-depth, layered, defensive approach that leverages people, processes, and encryption and multi-factor authentication technology to manage and mitigate cybersecurity threats. Peoples employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Peoples and the CISO leverage several technologies and a third-party Managed Security Service Provider to monitor and respond to cybersecurity threats. In the event that the CISO assesses a material risk from a potential cybersecurity threat, the CISO immediately notifies and works with Peoples' Crisis Management Team, which includes Peoples' General Counsel, to appropriately respond and mitigate the threat. If necessary, third-party resources will be engaged, with the support of Peoples' cyber insurance provider, to mitigate the cybersecurity threat, perform forensic activities and distribute appropriate notifications to impacted parties and/or regulators. In the event a material cybersecurity incident occurs that requires notification to the Board of Directors, the General Counsel and CEO will coordinate notifications to the Board of Directors and provide updates to the Board of Directors as needed.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 17 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Head of IT or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Oncternal Therapeutics, Inc.


text: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and conduct vendor risk assessments for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: We have processes in place for identifying, assessing and managing material risks associated with cybersecurity threats. For a discussion of how risks from cybersecurity threats affect our business, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Our CISO has 25 years of experience in the cybersecurity and technology space. Our Data Security Committee is composed of key business and functional stakeholders to include Risk, Legal, Finance, IT, Operations, and Business line leads.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: The individuals responsible for evaluating and managing the Company's cybersecurity risk have extensive experience managing organizational risk and implementing cybersecurity programs at companies. The CIO has more than 20 years of experience advising on the overall strategy of technology, including the incorporation of cyber security into the software development lifecycle and change management process. The CISO possesses more than 10 years of relevant expertise in cybersecurity and holds a Certified Information Systems Security Professional ("CISSP") certification. Other members of the Company's information security team also hold certifications such as CISSP, Certified Information Security Manager ("CISM"), Certified Ethical Hacker ("CEH"), and Certified Information Systems Auditor ("CISA"). The Chief Financial Officer has experience assessing and managing material financial risks, including cybersecurity risks, and serving on the Disclosure Committee at public companies. The Chief Legal Officer possesses many years of experience managing legal and compliance risk at public companies, including with respect to cybersecurity incidents. The Head of Internal Audit manages the Company's broader risk management framework, which includes cybersecurity risks, and has many years of prior experience assessing cybersecurity risks and programs at several companies.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide cybersecurity products to our customers, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems, our global network, and our customers' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against cyber threats. This approach to cybersecurity includes, among other things, annual and periodic enterprise-wide risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, data, and global network; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, network and data through ongoing testing, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing our risk management systems. These processes are integrated into our overall risk management systems and processes to promote a company-wide culture of cybersecurity risk management.

companyName: Cloudflare, Inc.

ticker: NET


text: We maintain a Cybersecurity Incident Management Policy (Cybersecurity Policy), which provides guidance and processes for preventing, identifying, assessing, mitigating, resolving and ensuring timely public disclosure, when appropriate, of cybersecurity threats, including both cybersecurity threats directed at our Company and those associated with our use of third-party service providers. We have retained a leading cybersecurity incident response vendor to assist us in responding to cybersecurity incidents and we maintain relationships with technology providers to help us recover or rebuild technology systems in the event of a large-scale cybersecurity incident.

companyName: EQT Corp

ticker: EQT


text: Our Head of IT, reporting to our Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the activities and systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our Head of IT has over 20 years of IT experience, including over 10 years experience in cybersecurity, data security and regulatory compliance. Our Security Leader reports to our Head of IT and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Security Leader has 20 years of IT experience.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Peoples' Chief Risk Officer ("CRO") reports to the Risk Committee and the Chief Operating Officer and has primary responsibility for the design and implementation of the ERM Program. The ERM Program establishes Peoples' risk appetite, monitors key risk and performance indicators, identifies key risks within the firm, designs and executes specific risk initiatives and monitors risk mitigation efforts and control processes. The CRO updates the Risk Committee quarterly on the overall risk condition of Peoples inclusive of any cybersecurity issues or threats.


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institution Examination Council ("FFIEC") Cybersecurity Assessment Tool, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Information and Operations Officer, along with key members of his team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions and maturing our Information Security Program.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of Information Technology ("IT"), who reports directly to our Chief Financial Officer. Our Director of IT has more than 20 years of experience working with enterprises to protect their systems from cybersecurity risks and to address other areas of risk management. We also engage other consultants and third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Anterix Inc.

ticker: ATEX


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer ("CISO") who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: QUALYS, INC.

ticker: QLYS


text: Notwithstanding the Corporation's defensive measures and processes, the threat posed by cyber-attacks is extremely serious. The Corporation may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on it. While the Company has not, to date, detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, its systems and those of its customers and third-party service providers are under constant threat. It is possible that the Corporation could experience a significant cybersecurity event. The Corporation expects risks and exposures related to cybersecurity attacks to remain high for the foreseeable future. Refer to Item 1A. "Risk Factors" for additional information related to cyber security risks.

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: We utilize a comprehensive, multi-layered approach for our cybersecurity management which is generally aligned with the National Institute on Standards and Technology Cybersecurity Framework. We have a number of controls and procedures in place to recognize potential cybersecurity threats and potential incidents and elevate such potential incidents to senior management and our outside advisors to determine the materiality of such incidents. Automated tools and our third party security operation center provide alerts to our cybersecurity staff regarding potential threats. We also use an array of defenses to protect our cybersecurity environment and mitigate cybersecurity threats, including multi-factor authentication, access controls, email filtering, firewalls, intrusion prevention and detection systems, partitioning and encryption of information, backup and data recovery procedures, malware defenses, disaster recovery and incident plan responses, hardware and software updates and patching, and related programs. We regularly assess the efficacy of these defenses and mitigation measures and implement improvements, focusing on critical matters. To further promote a culture of cybersecurity awareness and defense, we also have regular educational and training sessions for our relevant employee population about the importance of cybersecurity and our key information more generally.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Our senior leadership team, in collaboration with representatives from the Security Operations Team, as well as the legal, human resources, and finance departments, are responsible for developing and executing the company's overall risk management program, including cybersecurity policies. To enhance security, we have established an Information Security Program with a formal written security and incident response policy. This policy outlines methods for assessing, identifying, and mitigating risks. Our cybersecurity program incorporates multiple security layers, and we engage external security consultants to assess, audit, and monitor our security controls and events. Additionally, we require third-party service providers to implement and maintain appropriate security measures and promptly report any suspected breaches that may impact the Company. We also maintain a cybersecurity insurance policy.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: The Company has adopted policies, processes, procedures and standards and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Cybersecurity Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: N-able, Inc.

ticker: NABL


text: Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. In general, the Adviser seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Adviser's information systems or the information that the Adviser collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner.

companyName: HONG YUAN HOLDING GROUP

ticker: HGYN


text: Senior management is responsible for creating and recommending for approval to the Board of Directors risk appetite metrics related to cybersecurity, reflecting the aggregate levels and types of risk the Company is willing to accept in connection with the operation of our business and pursuit of our business objectives.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our Director of IT and Manager of IT Cybersecurity, Compliance and Data Privacy assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT, IT Steering Committee and IT Executive Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Investment Advisory Agreement. Pursuant to this policy, the Advisor and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.

companyName: Franklin BSP Real Estate Debt BDC


text: To date, risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our operations or financial standing. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect us. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: Urban One has implemented a structured approach to assessing, identifying, and managing cybersecurity risks. This framework includes ongoing monitoring of threats, the implementation of security controls, and proactive adaptation to evolving risks. Our cybersecurity strategy is designed to safeguard corporate assets, data, and critical systems while ensuring operational resilience.

companyName: URBAN ONE, INC.

ticker: UONE


text: Audits and testing of program effectiveness are coordinated by the Company's Senior Vice President of Audit who oversees the Audit Department and reports to the Audit Committee of the Board of Directors, independent of the technology and cybersecurity functions. The Audit Department utilizes independent third-party audit firms with technology and cybersecurity expertise. Results of all audits and independent assessments are delivered directly to senior management and the Audit Committee of the Board of Directors by the SVP of Audit.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Travis Smith, age 51, is Executive Vice President, Additives & Functional Products, Manufacturing, WWE&C and HSE with responsibility for the global manufacturing and Worldwide Engineering and Construction ("WWE&C") in addition to leadership of the AFP segment and Health, Safety and Environment ("HSE"). Mr. Smith joined the Company in December 1992 as a chemical engineer and has held various positions of increasing responsibility within manufacturing, the chemicals business, corporate innovation, specialty plastics, and advance materials during his career at Eastman. Mr. Smith assumed the position of Vice President and General Manager, Performance Films in July 2012 and for both Performance Films and Advance Interlayers in April 2018, and was appointed Senior Vice President with responsibility for the AFP segment effective October 2022. Mr. Smith was appointed to his current position effective January 2025.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and third-party systems.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: FOX's cybersecurity program is based on recognized best practices and standards applicable to our industry. The Company engages a third-party firm to assess the overall maturity of its program against the NIST Framework on a bi-annual basis. This evaluation includes an assessment of how the program evaluates and mitigates risk, as well as how it compares against industry benchmarks. The results of this evaluation are provided to the Audit Committee of the Board.

companyName: Fox Corp

ticker: FOXA


text: Information Security Incident Management Procedure based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework We utilize the Cybersecurity Framework of the NIST to outline the activities and authorize personnel to handle information security and cybersecurity incident responses within the Company. This procedure outlines the phases of the incident response process, including detection and analysis; containment and intelligence development; eradication and remediation; recovery; and post-incident activities. Assessments include the qualitative and quantitative factors that are essential for determining materiality on information security and cybersecurity incidents.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Emerson engages independent third-party cybersecurity experts to evaluate our cybersecurity maturity and test effectiveness of overall cybersecurity controls. To test and reinforce Emerson's internal cybersecurity processes, the Company utilizes an accredited and independent third party to audit and certify key elements of our primary data centers, cloud environments and our enterprise IT organization. The audits are conducted according to International Organization for Standardization (ISO) 27001 Framework, although this is not meant to imply that we meet all technical standards, specifications or requirements under ISO 27001. In addition to performing periodic, internal security reviews, the Company also conducts cybersecurity tabletop exercises led by third party cybersecurity consulting firms from time to time, with the last such engagement occurring in 2023.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Should we, or the third parties we do business with, fall victim to successful cyber-attacks or experience other cybersecurity incidents, the result could include negative consequences. Such consequences could include, but are not limited to: significant disruption of our operations and those of our customers, including losing access to important business systems; misappropriation of confidential information related to customers, counterparties, employees, or other parties; severe damage to our reputation; the inability, or extended delays in the ability, to fully recover and restore data that has been stolen, manipulated, or destroyed, or the inability to prevent systems from processing fraudulent transactions; violations of applicable privacy and other laws; financial loss to us or our customers, counterparties, or employees; exposure to the risk of litigation, regulation, and other liability, which may include fines or other penalties and increased cybersecurity or other insurance premiums. The extent of a particular cyber-attack and the steps we must take to investigate and respond to it may not be immediately clear, and it may take a significant amount of time before such an investigation can be completed.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We have implemented ongoing processes that are designed to continually identify, assess, manage and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our cybersecurity threat risks are identified, assessed, managed, and monitored by our Adviser's and Administrator's resource management and compliance departments, on our behalf, and work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists in maintaining our cyber and information security programs. The ISP proposes recommendations to our Adviser's resource management and compliance departments, which then are considered by other officers and employees of our Adviser and Administrator, working on our behalf, before improvements are implemented to our information technology strategy, cybersecurity, and incident response policies, processes and procedures.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: These programs are intended to decrease cybersecurity risks associated with human error and foster a culture of cybersecurity date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected, or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While our insurance covers certain cybersecurity related matters, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: Management of Cybersecurity Risks From a management perspective, our GISO, led by our Chief Information Security Officer, operates our cybersecurity program. Our program aligns with the NIST cybersecurity standard functions (Identify, Protect, Detect, Respond, Recover) and aims to secure our networks, information systems, information resources, data, services, and products against internal and external threats and mitigate security vulnerabilities while efficiently operating our business. We have integrated our cybersecurity program into our overall enterprise risk management program.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: We engage assessors, consultants, auditors and other third parties in connection with the above processes. We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we have established a process to assess and oversee the cybersecurity practices of our vendors. Before engaging with third-party service providers, we conduct due diligence to evaluate their cybersecurity capabilities and potential vulnerabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers, including adherence to specific security practices and protocols.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: The VPs of IT are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our VPs of IT have extensive experience leading cybersecurity oversight. Others on our IT security team have cybersecurity experience or certifications that support these efforts. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least annually and have access to more frequent cybersecurity trainings through online trainings. We employ ongoing random testing of phishing and other cybersecurity threats across our entire employee base on a weekly basis with follow-up communication on results of these tests to members of management. Failures of these random tests require team re-training efforts.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Our board of directors oversees cybersecurity as part of its risk oversight function. Our board of directors receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.

companyName: ON24 INC.

ticker: ONTF


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including that if our information technology systems or those of third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences, including disclosure of sensitive information, damage to our reputation, and significant financial and legal exposure.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management program. Our cybersecurity program has been built around the National Institute of Standards and Technology (NIST) framework with flexibility to support our product development, deployment, operations, and monitoring. The NIST framework organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover, with an emphasis on prevention, detection and mitigation. We have key Company policies that directly or indirectly relate to cybersecurity matters, including policies relating to antivirus protection, remote access, multifactor authentication, restricted access based upon business need and confidentiality of information, as well as procedures designed to reduce phishing, increase employee awareness of phishing attempts and other activities. The key elements of our efforts to identify, prevent, mitigate, and remediate cybersecurity risks and incidents through our cybersecurity risk management program include: • We collect and analyze information about cybersecurity risks as part of our risk management program and monitor and discuss public alerts, threat levels, trends and remediation. • All employees receive periodic cybersecurity training and are exposed to phishing simulations designed to educate concerning the recognition of cybersecurity threats. • We use various security tools, including internal reporting, monitoring, and bug bounty programs, to identify vulnerabilities in our products. • Regular system updates and patching are done to protect our hardware and software against security vulnerabilities. • We conduct simulations, drills, and penetration testing to test our defenses and monitor threat levels, including the periodic performance of simulations and tabletop exercises to test our policies, incorporating external resources and advisors as needed. • We have controls and procedures in place for prompt escalation of cybersecurity incidents and regularly evaluate and update contingency planning, including plans in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. • We partner with third-party security consultants to review our incident response process and ensure our programs align with industry standards. • We assess the cybersecurity preparedness of key vendors, review any reports on system and organizations controls, before onboarding and monitor their vulnerabilities, including any publicly reported vulnerabilities. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. • We have a cybersecurity risk insurance policy.

companyName: Cambium Networks Corp

ticker: CMBM


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Cyber security risk management at Noble, along with all enterprise risks, is part of the Company's Enterprise Risk Management Program and risks from cyber security threats are assessed, identified, and managed by our Information Security Team. The Information Security Team reports to the Chief Information Officer ("CIO"). The Information Security Team is composed of the Director of Information Security, managers, and security analysts.

companyName: Noble Corp plc

ticker: NE


text: Our cybersecurity risk management and strategy are integral components of our comprehensive information security program. They guide our continuous efforts to evaluate and improve the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: RiskOn International, Inc.


text: The CISO has a degree in Business Administration, Finance, and Risk Management from Washington State University. The CISO has over 23 years of experience in cybersecurity and information security. The CISO has maintained a Certified Information Systems Security Professional (CISSP) certification for over 18 years.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, mergers and acquisitions, and other relevant matters.

companyName: JUNIPER NETWORKS INC


text: Security Policy and Requirements: The Coherent Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment and prioritization, and as necessary, remediation plans. The Cybersecurity Team also performs periodic system penetration testing to validate the Company's security controls and assess Coherent's infrastructure and applications. All employees take mandatory periodic security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests. Additionally, the IT group and the Cybersecurity Team participate in annual tabletop exercises designed to simulate a response to a cybersecurity incident. The Cybersecurity Team incorporates the findings from these exercises into the Coherent processes. Further, in 2023, select members of the senior management team and the Cybersecurity Team participated in a tabletop exercise.

companyName: COHERENT CORP.

ticker: COHR


text: A Vendor Management program has been developed and employed to manage potential risks for third-party service providers, suppliers and external partners who have access to our confidential information. The effectiveness of these processes is verified by independent internal and external audit functions or organizations.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: Risks from Cybersecurity Threats Nordstrom has not experienced any cybersecurity incident that has materially impacted, or that is reasonably likely to materially impact, our operations, financial condition and cash flows.

companyName: NORDSTROM INC


text: As a financial institution, the Company's business depends on the continuous operation of its information and data processing systems and the security of information received from customers, employees and others. The Company has developed and implemented a cybersecurity program intended to protect the reliability of its critical systems and the confidentiality of nonpublic information.

companyName: PCB BANCORP

ticker: PCB


text: We have integrated aspects of our cybersecurity risk management processes into our overall risk management program through, for example, common methodologies, reporting channels and governance processes that apply across the overall risk management program to other risk areas.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Protecting our systems and data from cyber threats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to the transparent and ethical use of the personal data in its care and complying with applicable privacy-related regulations.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.

companyName: Otter Tail Corp

ticker: OTTR


text: The Cybersecurity Risk Management Program is designed to identify potential vulnerabilities and threats and develop strategies to mitigate and remediate them. To assess, identify, manage, address and minimize the effects of a cybersecurity threat or incident, or a series of related cybersecurity threats or incidents, the Company undertakes a range of activities, including monitoring of its systems and networks, incident response planning, and employee training. The Company also has business continuity and disaster recovery plans in place in the event of a cybersecurity incident, which are regularly reviewed and updated as needed. The Company also regularly engages third-party assessors, consultants, auditors, and other experts to help identify, assess and address potential threats or incidents.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: The Chief Financial Officer, Chief Business Officer, Chief Accounting Officer, Senior Vice President of Legal, Vice President of Information Technology, and certain third-party providers are members of our Cybersecurity Risk Management Committee and help identify, assess and manage the Company's cybersecurity threats and risks. This Cybersecurity Risk Management Committee, which reports to the Audit Committee of the Company's Board of Directors, is responsible for identifying and assessing risks from cybersecurity threats. The Cybersecurity Risk Management Committee monitors and evaluates our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, conducting scans of certain threat environments, evaluating certain cybersecurity threats reported to us, conducting internal and external audits of certain environments and systems, and performing third-party threat assessments.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Our overall cybersecurity risk management objective is to avoid or minimize the impacts of threat events that could lead to penetration, disruption or misuse of our information systems and to ensure compliance with applicable legal and contractual obligations. Our cybersecurity risk management improvement initiatives are informed by regulatory guidance, industry standards, threat intelligence feeds, internal and external audits, external consultants, and insights from cybersecurity community. Experts from our Technology Leadership Centre, under the supervision of the Chief Technology Officer, periodically review our cybersecurity risk management processes to address changing threats and conditions.

companyName: Freedom Holding Corp.

ticker: FRHC


text: All companies utilizing technology are subject to cybersecurity threats. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, extortion, harm to employees or customers and violation of data privacy or security laws. We aim to incorporate best practices throughout our cybersecurity program. Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees to help identify, avoid, and mitigate cybersecurity threats; policy regarding cybersecurity; mechanisms to detect and monitor unusual network activity; and containment and incident response procedures. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Direct Digital Holdings, Inc.

ticker: DRCT


text: The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.

companyName: ENB Financial Corp

ticker: ENBP


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The board of directors reviews and approves our information security and technology budgets and strategies annually.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB