text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. As of the date of this Annual Report, we have not encountered any cybersecurity incidents.

companyName: Jackson Acquisition Co II

ticker: JACS


text: Our Board of Directors exercises oversight of information security risk primarily through the Audit Committee. T he Head of Information Technology provides information security updates to named executive officers and briefs our Board of Directors and Audit Committee on relevant information security issues on a quarterly basis. We also make available periodic cybersecurity training for members of our Board of Directors.

companyName: ADAMAS TRUST, INC.

ticker: ADAM

secItem: Item 1C


text: We review the processes of our third-party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.

companyName: Checkpoint Therapeutics, Inc.


text: Engage Third-parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.

companyName: MSA Safety Inc

ticker: MSA


text: Cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition. Similar to other companies, we and our third-party vendors have and will continue to experience threats to our systems and data.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Our management engages with third-party experts who have significant IT expertise and broad cybersecurity experience, including in cybersecurity threat management, cybersecurity training and education, incident response, cyber forensics, insider threats, business continuity and disaster recovery, and regulatory compliance. Such individuals have significant prior work experience in various roles involving IT security, auditing, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents and design.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our employees, management and the Board on — our response to a cybersecurity incident.

companyName: authID Inc.

ticker: AUID


text: We have a vendor management process to manage cybersecurity risks associated with our use of independent service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve varying methods of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Company's information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data on our systems as well as securing our interfaces with our critical third-party service providers.

companyName: Capital Bancorp Inc

ticker: CBNK


text: In the event of a cybersecurity incident, we will coordinate with our third-party cybersecurity advisor to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: KINETA, INC./DE


text: e.through policy, practice and contract (as applicable), require employees, as well as third-parties who provide services on our behalf, to protect customer information and data;

companyName: TruBridge, Inc.

ticker: TBRG


text: As discussed further in "Item 1. Business—Our Adviser and Ellington," we are externally managed and advised by our Adviser, an affiliate of Ellington. Our Adviser does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Credit Co

ticker: EARN


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and assess cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, for example, by engaging with known, reputable vendors, and requiring they have industry standard safeguards and notification procedures. We may also ask vendors associated with increased cybersecurity risk to complete a periodic questionnaire regarding their security practices for ongoing vendor management purposes.

companyName: Profound Medical Corp.

ticker: PROF


text: For a discussion regarding risks from cybersecurity threats that are reasonably likely to affect the Company, see "Part I, Item 1A – Risk Factors – Our use of information technology exposes us to cybersecurity attacks and other interruptions that could disrupt our business operations and adversely impact our reputation and results of operations," "Cybersecurity attacks, business interruptions, and compliance issues experienced by third parties could materially and adversely affect our financial condition, results of operation and cash flows" and "If we fail to comply with data privacy and personal data protection laws, we could be subject to adverse publicity, government enforcement actions and/or private litigation, which may negatively impact our business and operating results."

companyName: Monster Beverage Corp

ticker: MNST


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Management and Strategy

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service its members and protect the privacy of their data entrusted to the Bank, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Atlanta


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We utilize automated intrusion prevention, detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: In 2022, we engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and, throughout 2023, engaged with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means. To date we had no cybersecurity incidents.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: The Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's major cybersecurity risk exposures and the steps that the Company's management has taken to monitor and control such exposures. Specifically, the Audit Committee reviews updates on data management, security initiatives, and significant existing and emerging cybersecurity risks, including material cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: We have implemented best practices and established numerous programs and controls to reduce cybersecurity risk. Our Information Security Program includes physical, administrative, and technical safeguards. Some key components of the Information Security Program include: Security awareness training for Team Members. A dedicated security operations team to monitor, analyze, and respond to security threats. Security governance to manage and maintain security processes. Intrusion, detection, and prevention systems. A vulnerability management program to identify and remediate security liabilities. A configuration management program to harden systems based on industry standards. Industry-leading email security, endpoint detection, and response platforms. Threat intelligence from multiple resources to identify and anticipate emerging threats. Network and web application firewalls. Identity security to include multi-factor authentication. Network segmentation to isolate and safeguard critical systems and sensitive data.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Employee Training: All employees receive mandatory cyber security awareness training at onboarding, covering phishing prevention, secure data handling and how to recognize common attack strategies and reporting suspicious activities.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Under the oversight of our Board of Directors, and the Board's risk committee, our management has established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. Our processes include detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be followed from detection to assessment to notification and recovery, including internal notifications to management, the risk committee and the Board, as appropriate.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our Chief Product and Technology Officer and approves our technology strategic plan.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Advisor's Chief Operating Officer ("COO") and Chief Compliance Officer ("CCO") regarding the overall state of the Investment Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Advisor and its affiliates take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout their operations that are designed to address cybersecurity threats and incidents. The Advisor and its affiliates regularly assess risks from cybersecurity threats, monitor their information systems for potential vulnerabilities, and test those systems according to their cybersecurity policies, standards, processes, and practices, which are integrated into their overall approach to enterprise risk management. To protect their information systems from cybersecurity threats, the Advisor and its affiliates use various security tools that help them identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: Lightstone Value Plus REIT II, Inc.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, " Risk Factors," in this Report. We maintain a cyber liability insurance policy. However, our cyber liability insurance policy may not cover all claims made against us, and defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations.

companyName: TECHPRECISION CORP

ticker: TPCS


text: Additionally, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and reports cybersecurity incidents that reach designated thresholds to senior management and, if necessary, to the Governance and Nominating committee. Our CISO has been with the Company since 1997, has held numerous roles in information technology and has led the information security program since 2016. Our CTO, to whom the CISO reports, has been with the Company since 2013 and has served as the Company's CTO since 2025.

companyName: TYSON FOODS, INC.

ticker: TSN


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and or damage to our business relationships, all of which could negatively impact the Fund."

companyName: CIM Opportunity Zone Fund, L.P.


text: Heading our cybersecurity program is our Chief Information Officer ("CIO"). Our CIO has over 30 years of experience in Software Engineering and Information Technology/Cybersecurity and is supported by skilled professionals from our Information Technology team. This seasoned team provides regular updates to our Enterprise Risk Management Steering Committee (the "ERM"), composed of our Chief Executive Officer, Chief Financial Officer, Chief Administrative Officer, and other members of our senior leadership. Our Audit Committee and Board of Directors receive regular reports from the ERM, as well as directly from our CIO on a quarterly basis. These reports cover various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: SunOpta Inc.

ticker: STKL


text: The Adviser's cybersecurity program prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact us. The Adviser's cybersecurity program is aligned to the Center for Internet Security critical controls framework. The Adviser's cybersecurity risk management processes applicable to us include technical security controls, policy enforcement mechanisms, monitoring systems, and other tools. Third-party providers are leveraged to assist in assessing, identifying and managing risks from cybersecurity threats applicable to us. The assessment of cybersecurity risks, including those which may be applicable to us, is integrated into the Adviser's overall risk management program. The Adviser has implemented and continues to implement risk-based controls designed to prevent, detect, and respond to information security threats and we rely on such controls.

companyName: HPS Corporate Lending Fund


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, and in subsequent filings with the SEC. We recognized $24.6 million of expenses related to the Cybersecurity Incident, net of insurance recoveries during fiscal 2024. In addition, we were named, and may still be named, as a defendant in lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. Further, we have engaged with and continue to engage with regulators related to the Cybersecurity Incident. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, we currently do not expect that the Cybersecurity Incident will have a material effect on our overall financial condition or on our ongoing results of operations beyond those amounts already accrued. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs."

companyName: loanDepot, Inc.

ticker: LDI


text: Executive Officer and Chief Financial Officer are primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from the Vice President of Technology and third-party service providers.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: We rely on a multidisciplinary team, including our information security personnel, legal department, management, and third-party service providers, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. We perform simulations and drills for responding to cybersecurity threats at both a technical and management level. We incorporate external expertise and reviews in all aspects of our cybersecurity program. All of our employees receive annual cybersecurity awareness training.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Management is responsible for the development of all cybersecurity programs, including the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Board receives quarterly reports regarding the overall cybersecurity risk management process. The Board and Audit Committee are responsible for information security oversight. Two members of the Company's Board have relevant information security and cybersecurity experience. As part of their oversight, senior leadership meets with the Audit Committee at least annually to discuss information security and cybersecurity matters.

companyName: ALLIENT INC

ticker: ALNT


text: Our Cybersecurity management framework is aligned with the Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology (NIST) and COBIT 2019. This framework provides a structured approach to managing our policies, standards, and processes, improving our cyber security posture. Additionally, we maintain SOC2 compliance, demonstrating our adherence to industry-recognized security standards and best practices.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. In addition, subsequent to our fiscal year end, on January 6, 2025, we became a member of the Retail & Hospitality — Information Sharing and Analysis Center, a non-profit organization that will allow us to further strengthen our cybersecurity risk management by gaining gaming industry specific knowledge and intelligence.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: Cyber Risk Management and Strategy We have processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties, including a contracted information technology consultant who is dedicated to our organization, to enhance our cybersecurity oversight.

companyName: PepGen Inc.

ticker: PEPG


text: Our cybersecurity program is managed by our IT Director, who reports directly to senior management on matters regarding cybersecurity, as appropriate. Our IT Director has over twenty years of experience in IT, including cybersecurity, and previously served as the IT Director at another biopharmaceutical company. Together, our senior management and IT Director are responsible for leading company-wide cybersecurity strategy, policies, standards, and processes.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of the adviser and FS Investments.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our Audit Committee, together with our information security function and third-party service providers help identify, assess, and manage the Company's cybersecurity threats and risks. Additionally they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting threat assessments for internal and external threats, third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and using external intelligence feeds.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors (the "Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources..

companyName: BRINKS CO

ticker: BCO


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Neelu Sethi serves as the Global CIO and reports to Kurt McMaken, the CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity, risk and compliance team. The CISO has served in this role since September 2018. Our CISO has over 20 years of experience in IT security management and served as the director of information security and chief security architect in the insurance sector prior to joining PSEG. Our CISO has a bachelor's degree in electrical engineering and holds multiple security certifications, including Certificate of Cloud Security Knowledge, Certified Information Systems Security Professional, Certified Information Systems Auditor, Information Systems Security Architecture Professional, and National Institute of Standards and Technology Cyber Security Professional Practitioner.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Additionally, we monitor emerging laws, industry standards, and regulations related to information security and data protection. Although we have not experienced any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date, and though we are actively monitoring our networks and access points by implementing security updates regularly, we cannot provide any assurance that there will not be incidents or threats in the future that may materially affect us, including our business strategy, results of operations, or financial condition. Pursuant to our risk management policy, responsibility for the implementation of our risk management policy resides with the Chief Financial Officer. The Audit Committee receives an update on the Company's risk management process, risk trends and any incidents at least annually from the management team. In the event of any incident, the Company expects to notify the Audit Committee immediately, or as soon as possible.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: Our management, including leaders from our IT, information security, legal, and compliance teams, is responsible for implementing our Cybersecurity standards, policies, and operating procedures, under the ultimate oversight of our Chief Financial Officer. We regularly discuss and assess Cybersecurity risks.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: We manage risk, including cybersecurity risk, via three distinct lines of defense. As the first line of defense, business managers, including IT managers, are responsible for maintaining effective internal controls and executing risk and control procedures on a day-to-day basis. As the second line of defense, the legal, compliance and information security governance functions provide guidance and training, as well as perform monitoring, testing and surveillance activities relating to compliance with the firm's policies and procedures, applicable laws and regulations, contractual requirements, ethical standards and industry best practices. As the third line of defense, our internal audit team provides periodic and independent assurance that the firm's internal controls are implemented and operating effectively.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We leverage the ISO 27001 framework for cybersecurity risk management. Our cybersecurity risk management strategy is frequently reviewed and adapted to address and meet current and emerging threats. Risk treatment plans are strategically prioritized and executed, and residual risks are reported through our enterprise risk program and elevated to executive management and the Board.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: The Risk Committee is comprised of members of the Company's senior management, who have managed and overseen cybersecurity risk at numerous public companies. The Company's head of IT has overseen cybersecurity strategy, cybersecurity risk management, engineering of security technology, managed security service providers, processes and governance at other publicly traded companies and holds industry-standard certifications with respect to cybersecurity risk management.

companyName: Orion Properties Inc.

ticker: ONL


text: The Hines cybersecurity program focuses on the following areas: • Vigilance: Hines' cybersecurity threat operations function around the clock to identify, prevent and mitigate cybersecurity threats and respond to any incidents timely. • Systems Safeguards: Hines deploys systems safeguards that are designed to protect our information systems from cybersecurity threats, including email filtering, website filtering, virus protection, disk drive encryption, multi-factor authentication, mobile device management, and robust network equipment, which are evaluated and improved through ongoing penetration tests and both internal and external audits. • Collaboration: Hines utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. These collaborative efforts include relationships with security operation center service and brand protection providers as well as cloud-based backup service providers. • Third-Party Risk Management: Hines utilizes a risk-based approach to cybersecurity risks presented by third parties, including the systems of third parties that could adversely impact our business. • Training: Hines provides periodic training for personnel regarding cybersecurity threats, such as cybersecurity awareness videos and phishing campaigns. Such training is adjusted to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Communication: Hines has formed an incident response team to address potential cybersecurity incidents. This team is composed of management personnel from Hines' technology, operations, legal, risk management, internal audit and other key business functions and is responsible for informing Hines' leadership, as necessary. The team also includes at least one of our officers to ensure that decisions regarding the disclosure and reporting of such incidents can be made by us in a timely manner, including communicating to our board of directors, if applicable.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Physical Security. We control physical access to our facilities, areas within our facilities, data centers, server rooms, and equipment. Manufacturing and research and development is conducted out of our Maryland facility that employs badging, visitor registries, escorts for visitors, exit/removal procedures, and physical locks/access controls as appropriate and necessary. Our corporate office in Utah is equipped with physical security including locks/access controls to the facility and to secure all IT-related equipment and personnel files. Installation, maintenance, and repair of equipment is restricted to authorized personnel. We protect our Computer Equipment from power failure, surges, and other electrical anomalies, and cabling is protected from unauthorized access or damage. Access to our network services is restricted to authorized individuals and granted only following individual identification and authentication. Local wireless access is limited to authorized entry points, with various forms of authentication required before access is granted to authorized individuals.

companyName: Clene Inc.

ticker: CLNN


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, managing incident and breach response and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example cybersecurity consultants and professional services firms (including legal counsel).

companyName: GENELUX Corp

ticker: GNLX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, cybersecurity consultants, managed cybersecurity service providers, penetration testing firms, and as needed, forensics investigators.

companyName: PagerDuty, Inc.

ticker: PD


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and next generation detection platforms, security automation orchestration and response, and protection platforms designed to stop initial malicious activity. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we have a shared responsibility model with these third parties and require them to implement security programs commensurate with their risk. We cannot ensure that in all circumstances their efforts will be successful.

companyName: WideOpenWest, Inc.

ticker: WOW


text: The Company has developed a training program to educate employees about its cybersecurity policies and standards, best practices, and potential threats to instill a culture of cybersecurity awareness and compliance throughout the organization. The training program includes, but is not limited to, ongoing and targeted training on topics such as social engineering, mobile security, data handling and protection, password security and incident reporting. All employees are required to participate in the training.

companyName: BankUnited, Inc.

ticker: BKU


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our Executive Officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: The Company continually evaluates and refines its cybersecurity program in response to key factors such as evolving threat landscapes, program maturation, gap analysis, and guidance from external security consultants. The Company's cybersecurity program relies on three key pillars: People, Process and Technology (PPT) to deliver a robust cybersecurity program. The cybersecurity program includes various aspects of PPT, including, but not limited to: Technology: Encryption, threat management, backups, monitoring, investigative support utilizing artificial intelligence embedded tools; Identity and Access Control Management Tools: Multi-factor authentication, monitoring and alerting of privilege account access; Cybersecurity Processes: Vulnerability scanning, penetration testing, and periodic assessments conducted by external security consultants;

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business, and our reliance on the Sixth Street and its affiliates in managing these risks, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition" in this Annual Report on Form 10-K.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our incident response plan; • incident detection and response processes; • a disaster recovery/business continuity plan; • encryption of certain data; • network security controls; • access controls; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • outsourced cybersecurity staff.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Board of Directors (the "Board") has risk oversight responsibility for the cybersecurity and data privacy risk management programs of TMCC, which are administered directly and with assistance from the Cybersecurity Committee of the Board.

companyName: TOYOTA MOTOR CREDIT CORP


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats and have processes for monitoring and assessing strategic risk exposures and reporting to the Audit Committee and board of directors. We regularly assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within our IT infrastructure.

companyName: RxSight, Inc.

ticker: RXST


text: Key cybersecurity risks are incorporated into our enterprise risk management framework. Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risk management actions into five categories: identify, protect, detect, respond, and recover. The Company's cybersecurity risk management program and strategy includes the following: • Cybersecurity Operations Centers - We, along with certain third-parties, operate several global cybersecurity operations centers, which provide 24/7 monitoring and incident response capabilities. In the event of an alert, our cybersecurity operations centers coordinates the investigation and remediation of such alerts. • Partnerships with Cybersecurity Companies - We partner with specialized cybersecurity companies and organizations, leveraging third-party technology and expertise. These partnerships help monitor and maintain the performance and effectiveness of our cybersecurity products. • Annual and Periodic Assessments by Third Parties - Our cyber risk management program undergoes periodic assessments by third parties and including annual penetration and disaster recovery tests. • Policies and Training - We maintain company-wide policies and procedures concerning cybersecurity, which are reviewed and approved by appropriate management members. All employees are required to complete cybersecurity training periodically, with additional specialized trainings for certain roles. We conduct monthly phishing simulation exercises with mandatory training on failure. • Incident Response - In case of a cybersecurity incident, we follow a documented incident response process, which outlines steps from detection to mitigation, recovery, and notification, including notifying senior leadership and the Board as appropriate based on severity. • Third-Party Service Providers - In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.

companyName: QUAKER CHEMICAL CORP

ticker: KWR


text: Management, led by the IT department, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The IT department is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.

companyName: cbdMD, Inc.

ticker: YCBD


text: The Company is externally managed by the Adviser and has no employees or internal information systems. Thus, the Company relies on the Adviser and the Administrator, their parent company, Crescent, as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO"), together with Crescent's Head of Information Technology, oversee the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. Crescent uses various security tools and procedures that help the Company identify, escalate, investigate, resolve and recover from cybersecurity incidents in a timely manner.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: In the event of an incident, EOG has a designated response team and written response plan in place with predefined escalation and response procedures. EOG also has processes in place to monitor the cybersecurity risk exposure and security practices of key service providers to assess their cyber preparedness.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our Adviser engages in the periodic assessment and testing of our Adviser's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Adviser adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems, and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: Our Board of Directors is engaged in the Company's ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Quality Committee of the Board oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee receives regular updates on the Company's cybersecurity risk management program from the CISO and CIO.

companyName: Medtronic plc

ticker: MDT


text: The management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Hess; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Hess Midstream LP

ticker: HESM


text: As part of our overall enterprise risk management program, we maintain a robust cybersecurity risk management program. The cross-functional group responsible for the cybersecurity risk management program includes members of our information security, data privacy and product security personnel, including members of our senior management team. Our cybersecurity program provides a foundation for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and overall risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing the relevant members of our senior management team, which informs the Audit Committee and our Board of Directors of material cybersecurity threats and incidents.

companyName: SentinelOne, Inc.

ticker: S


text: Education and Awareness We provide mandatory training for all employees and consultants regarding cybersecurity threats. The goal of the training is to equip our employees with tools and to raise their awareness of cybersecurity risks the Company faces. We conduct random training campaigns via email to test their knowledge and responses. We regularly communicate tips and current events to keep cybersecurity top of mind.

companyName: Eiger BioPharmaceuticals, Inc.


text: In its oversight role, our Board of Directors is expected to specifically consider risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: Management Oversight Our Chief Information Security Officer ("CISO") leads our Information Security and Data Privacy Council, which meets quarterly, or more frequently if necessary, to assess, identify and manage cybersecurity threats, support advocacy programs and advise our Chief Information Officer ("CIO") and CISO on solutions. The council is made up of key members of senior management across the Firm, including enterprise security, human resources, legal, internal audit, finance, procurement, communications and field management.

companyName: KFORCE INC

ticker: KFRC


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management system and are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems.

companyName: Next Technology Holding Inc.

ticker: NXTT


text: Considering the pervasive and increasing threat from cyberattacks, the board and the audit committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company to mitigate and prevent cyberattacks. The audit committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the audit committee or the full board regularly on their assessment of the Company's cybersecurity program and risks. Both the audit committee and the full board will receive regular reports from its senior management on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our board has risk management experience. We hire consultant and third parties to conduct our threat assessments and supplement the monitoring of such threats addition, the Company's information security and/cybersecurity program is managed by our Chief Technology Officer ("CTO") a, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CTO provides periodic reports to our audit committee as well as our Co-Chief Executive Officers and Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our CTO, Mr. Eliran Ben-Zikri served in the one of the most elite computer units of the Israeli Defense Force and has over 10 years of experience in the cloud technology, previously holding senior positions in leading Israeli technology companies, including of the date of this report, the Company is not aware of risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. This is exemplified in the way our IT Security Incident Response Plan forms an integral part of the broader risk management framework, so that cybersecurity risks are visible and treated as strategic business risks.

companyName: Cidara Therapeutics, Inc.


text: CYBERSECURITY GOVERNANCE Sempra's, SDG&E's and SoCalGas' respective boards of directors consider cybersecurity risk as part of their risk oversight function. The Sempra board of directors has delegated to its SST Committee, which is entirely composed of independent directors under the independence standards established by the NYSE, oversight of cybersecurity and other information and operational technology risks. The SST Committee reports to the Sempra board of directors regarding the Committee's activities, including those related to cybersecurity. The SST Committee receives briefings on cybersecurity topics from Sempra's chief information security officer, internal information security staff or external experts in part for continuing education on topics that impact public companies. The SST Committee as well as the SDG&E and SoCalGas boards of directors oversee management's implementation of our cybersecurity risk management processes and receive regular reports from management on our material cybersecurity risks. In addition, management updates the SST Committee and SDG&E and SoCalGas boards of directors about certain cybersecurity incidents. The SDG&E and SoCalGas boards of directors receive briefings from SDG&E's and SoCalGas' chief information officer and internal information security staff. SDG&E's and SoCalGas' boards of directors also have safety committees that, at times, may oversee the matters described above on behalf of those companies' respective boards of directors.

companyName: SEMPRA

ticker: SREA


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Collaborate with the legal department for awareness of emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct monthly phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Send periodic company-wide communications to raise employee awareness of social engineering and other forms of attack and how to guard against those; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.

companyName: TrueBlue, Inc.

ticker: TBI


text: conduct regular risk assessments of our information systems to identify weaknesses, and develop and implement mitigations to improve our cybersecurity and information security program;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: The Board may receive reports from our IT Department and/or Management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: EMERSON RADIO CORP

ticker: MSN


text: Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint;

companyName: AvePoint, Inc.

ticker: AVPT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors".

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: We also use threat intelligence to inform our defensive measures. We use external and internal threat intelligence sources, including information from vendors and Information Sharing and Analysis Centers.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Our Cybersecurity Program includes the following processes: • Quarterly control reviews, annual policy reviews and annual investments in our security infrastructure; • Periodic testing of our information systems to assess our vulnerability to cyber risk, which includes targeted penetration testing and vulnerability scanning; • Testing and audits of our IT-related internal controls over financial reporting, excluding cybersecurity controls, by our internal auditors; • Conducting a comprehensive information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees; • Annually assess the Cybersecurity Program against the NIST Framework; • Maintaining business continuity, contingency and recovery plans to quickly react to cybersecurity incidents; • Conducting security assessments of all third-party service providers with access to personal, confidential or proprietary information before engagement and maintaining ongoing monitoring by reviewing system and organization controls reports, relevant cyber attestations, and other independent cyber ratings; • Retaining a third-party cybersecurity provider for emergency incident response services in the event of a serious information security breach; and • Maintaining cybersecurity risk insurance that could help defray the costs of an information security breach as a backstop to the Cybersecurity Program.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into technology projects based on severity and priority. The Chief Information Security Officer ("CISO"), who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience at the Company and elsewhere, leads our global information security organization responsible for overseeing the Coupang information security program. The CISO regularly reviews our cyber strategy with technology leadership in order to assess whether the cyber strategy is integrated across the organization. The CISO receives reports on cybersecurity threats from experienced information security officers in our security organization on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. We conduct annual assessments by certified external third-party assessors as part of our industry-recognized information security certifications, ISMS-P and ISO 27001. We also periodically have external third-party consultants conduct maturity assessments of our Information Security program. The results of these audits and assessments inform us about possible risks which are managed through our enterprise risk management process. We also employ external third-party vendors to provide cyber threat intelligence when relevant information is available or as requested. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

companyName: Coupang, Inc.

ticker: CPNG


text: Our CIO assumed his position effective June 1, 2024, following the retirement of his predecessor. He previously served as the head of our Cybersecurity team. Our CIO has 28 years of experience in highly regulated industries managing information security in complex, matrixed environments. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.

companyName: PBF Energy Inc.

ticker: PBF


text: The Risk Committee receives periodic updates from our CISO, and other persons the Risk Committee deems appropriate, on a range of cybersecurity matters, including those referenced above as well as on the status of the Company's cybersecurity posture and risk mitigation efforts. If cyber-related issues arise between Risk Committee meetings that the CISO believes could have a material adverse impact on the Company, the CISO, or another appropriate risk management leader, will report to the Chair of the Risk Committee.

companyName: F5, INC.

ticker: FFIV


text: Our m anagement is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with the Adviser's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: HPS Corporate Capital Solutions Fund


text: The Audit Committee of the Board provides oversight in connection with management's cybersecurity efforts. The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to cybersecurity. The Audit Committee also receives regular reports on the efficacy of our cybersecurity risks and related policies and procedures from our chief information officer and other members of senior management who are tasked with monitoring cybersecurity risks. Our chief information officer oversees a dedicated team of certified cybersecurity professionals, with an average of over 12 years of relevant experience.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Network Security Management. The security of the Company's network infrastructure is maintained via the use of some network segmentation to isolate access to certain applications and systems, email filtering to identify spam, malware, and phishing messages in received email messages, data loss prevention controls to prevent the theft, or mass exfiltration of data, Virtual Private Networks to control remote access to our network, network access controls are in place to prevent unauthorized assets from connecting to the network, and web filtering.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: In order to maintain a strong cybersecurity program, our insurance business, Markel, uses a variety of controls and technology tools designed to identify, detect, prevent, respond to, and recover from security threats. Markel undergoes regular security audits including a System and Organization Controls, or SOC, audit for Cybersecurity conducted annually by independent auditors in which cybersecurity threats are identified and assessed. Markel regularly tests aspects of its internal security and conducts security risk interviews and assessments on third parties with whom it does business, depending on the nature of the relationship. Markel has invested in technology that assists its risk management teams in measuring and addressing weaknesses in its third-party and supply chain community. Markel performs continuous monitoring of all its critical third parties to ensure they are maintaining acceptable levels of security controls and remediating any known weaknesses.

companyName: MARKEL GROUP INC.

ticker: MKL


text: We address the risk from cybersecurity threats using a cross-functional approach, involving management personnel from our technology, operations, legal, corporate risk & compliance, internal audit and other key business functions in an ongoing dialogue regarding cybersecurity threats and incidents. As described in "Board Oversight" below, we also regularly report to the Board and the Risk Policy and Capital Committee of the Board on cybersecurity risk matters. We have implemented controls and procedures for the escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such incidents can be made in a timely manner.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have implemented incident response and business continuity plans for our operations, which are regularly tested with respect to our business-critical infrastructure and systems. We employ data backup procedures that seek to ensure that our key business systems and data are regularly backed up, and can be restored promptly if, and as needed. In addition, we generally store backup information at off-site locations, in order to seek to minimize our risk of loss of key data in the event of a disaster. Our recovery plans involve arrangements with our off-site, secure data centers and cloud infrastructure. We believe we will be able to utilize these plans to efficiently recover key system functionality in the event that our primary systems are unavailable due to various scenarios, such as natural disasters.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: The Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive reports on cybersecurity risks from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Disclosure of cybersecurity risk management, & strategy Management is responsible for the oversight and administration of cyber security protocols. Our strategy is to mitigate risks preventatively through cybersecurity strategies and preventative measures carried out by third-party providers. The Company regularly assesses, identifies, and manages these material risks in partnership with its third-party providers.

companyName: PISMO COAST VILLAGE INC


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We do not currently engage in any business activities that provide revenue or cash flow. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: LEGACY VENTURES INTERNATIONAL INC.

ticker: LGYV


text: If theft of any item identified under GLBA Inventory and Asset Classification has occurred, and it cannot be determined what specific information was included on the Asset, the Asset is treated as if it contained sensitive customer information and Senior Management, the Compliance Officer and the Information Technology Administrator must be contacted immediately. If the Information Technology Administrator and Senior\Compliance Management declare an incident or if there is a confirmed theft or loss of customer information, appropriate regulatory authorities, law enforcement, and legal counsel are notified.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: We regularly evaluate cybersecurity risks through discussions and updates with our Chief Executive Officer ("CEO"), who oversees our cybersecurity strategy. The CEO ensures that our management team can identify, evaluate, and manage cyber risks effectively and deploy measures to address and mitigate potential cyber incidents. This governance structure ensures that cybersecurity remains a central element of our strategic planning and risk management philosophy.

companyName: Crypto Co

ticker: CRCW


text: Our Chief Information Security Officer ("CISO"), General Counsel, Chief Strategy and Business Development Officer ("CSBDO"), and other senior members of our digital and technology and risk teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit Committee and/or the full Board of Directors Management receives a cybersecurity and information security maturity assessment from a third-party assessor biannually to gain a third-party view of our cybersecurity and information security program. We have integrated the identification, assessment and management of cybersecurity risks into VF's enterprise risk management program, ensuring alignment with our overall approach to risk oversight by the Board, its committees, and management. The Board receives an annual update from VF senior leadership on cybersecurity and information security matters. The Audit Committee receives regular reports from VF senior leadership, including the CISO, on cyber threats, information security risks and controls, and other program updates, as well as enterprise risk management program updates. The Audit Committee regularly briefs the Board on these cybersecurity matters, and the Board also receives periodic briefings on cyber threats and best practices to enhance our directors' literacy on cybersecurity and information security issues.

companyName: V F CORP

ticker: VFC


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and receives updates from management quarterly. At least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee and Board generally receive materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also integrated into Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: Sunrun Inc.

ticker: RUN


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business, operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. See Risk Factors for more information on our cybersecurity risks.

companyName: FIRST INDUSTRIAL LP


text: We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: Weatherford personnel perform risk assessments on third-party products and platforms through a checklist-based review and interview process that aim to validate security controls. Third parties are often asked to provide additional documentation on security architecture, certifications and results of assessments. Cybersecurity approval is a key factor in approving a new third-party product or platform.

companyName: Weatherford International plc

ticker: WFRD


text: Together with the MSP, we have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan will be tested and evaluated on a regular basis.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Protections against insider threat is a critical component of our security strategy, particularly within our defense business units. Our insider threat detection processes are designed to identify and evaluate potential insider threats so that appropriate mitigation can be implemented.

companyName: TEXTRON INC

ticker: TXT


text: We continuously monitor cybersecurity risks and adjust our cybersecurity risk management program and practices as needed. As part of our program, we occasionally identify risks or threats to our systems, including ransomware and attempts to obtain team member credentials through both phishing attacks or social engineering. While these risks and threats require active and ongoing efforts to mitigate, we have not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our operations, business strategy, or financial condition.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: The Board receives regular updates from the Audit Committee on cybersecurity risks, often with the participation of the Chief Information Security Officer ("CISO") to report on our information security activities. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: TechnipFMC plc

ticker: FTI


text: Commitment to Continuous Improvement Recognizing the dynamic nature of cyber threats, particularly in the digital medicine sector, our incident response plan is subject to ongoing review and refinement. We will regularly update our procedures to incorporate any lessons learned from past incidents and emerging best practices in cybersecurity.

companyName: QHSLab, Inc.

ticker: USAQ


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: We enlist third-party service providers across our business functions, including application providers, hosting companies, contract manufacturers, and supply chain resources. Depending on the service type, data sensitivity, and provider identity, our vendor management process assesses cybersecurity risks and establishes corresponding contractual cybersecurity obligations, tailored to each provider's role and the nature of Information Systems and Data involved.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: We have established a risk assessment methodology which includes requirements for treatment plans, risk acceptance thresholds, prioritization, and control analysis, as well as likelihood and impact analysis. A risk assessment is performed annually. Treatment plans are monitored and reported to management on a quarterly basis.

companyName: Infinera Corp


text: Vijay Mani is our VP of IT. He is responsible for managing our information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Mr. Mani has 16 years of experience working in leadership roles in information technology, as well as relevant degrees and certifications, including an Advanced Computer Security Certificate from Stanford University. He reports directly to our Chief Financial Officer and meets periodically with the Nominating, Governance and Risk Committee.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: Our Board also receives briefings from Yubo Beijing's management on the cyber risk management program. Board members receive presentations on cybersecurity topics certain Yubo Beijing's management, internal security staff or external experts as part of our Board's continuing education on topics that impact public companies.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Although no cybersecurity incidents during the year ended December 31, 2023 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.

companyName: Dauch Corp

ticker: DCH


text: See the section titled Item IA. Risk Factors, including "If our information technology systems, or those of third parties upon which we rely, or our data are or were compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences", for additional information about the risks from cybersecurity threats that may materially affect our business.

companyName: Asana, Inc.

ticker: ASAN


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These cybersecurity processes are integrated into the Company's overall compliance, risk management, and oversight procedures as overseen by the Company's board of directors, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company's process allows us to assess, identify and manage information security and cybersecurity threats through risk assessment and prevention measures to facilitate communication, training, awareness, incident response, and disclosure procedures as required by the SEC.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer, Vice President of IT, and the Information Security Manager. The Information Security Manager provides a weekly report to the Vice President of IT, which contains an overview of the activity in the department, any United States Computer Emergency Readiness Team alerts processed and all findings from the preventative maintenance tools. The Vice President of IT provides such report to the Chief Financial Officer on a quarterly basis. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: In 2024, the Company appointed a new Chief Information Security Officer (CISO). The new CISO has over 25 years of experience in Cyber Security, Information Security, Risk Management, and Information Technology. He has served as CISO and SVP at a financial institution, overseeing cyber and information security policies and ensuring compliance and security for new product implementations. Previously, he was VP, Head of Cybersecurity at another financial institution and held key roles at a financial services company. He is actively involved in advisory roles and professional boards, and he holds advanced degrees and certifications in information systems and security. The CISO holds a Bachelor's in Science in Managed Information Systems from Saint Peter's University, a Master of Science in Information Systems with a concentration in Information Security from Stevens Institute of Technology, Hoboken, NJ, and a Graduate Certificate in Business Process Management and Service Innovation from Stevens Institute of Technology, Hoboken, NJ.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to develop our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.

companyName: Unity Software Inc.

ticker: U


text: Invesco's information security program is led by its Chief Information Security Officer who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco's information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco Galaxy Ethereum ETF

ticker: QETH


text: Incident Response and Assessment Policies and Procedures Axon has implemented our cybersecurity and information security program and cybersecurity incident response plan to protect our and our customers' data from, and mitigate the effects of, unintentional disclosure as well as cybersecurity threats and incidents of all severity levels. Our program and response plan outline actions to be taken after identifying a suspected cybersecurity threat or incident and the people responsible for managing those actions. We have also implemented disclosure controls and procedures for determining the materiality of a cybersecurity incident to outline disclosure and communications responsibilities during cybersecurity incidents of all severity levels.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Occasionally, we have encountered cybersecurity threats necessitating adjustments to our procedures and the integration of extra safeguards. Although these specific threats or incidents haven't significantly impacted us thus far, it is possible that future threats and incidents we detect could potentially have a material adverse effect on our business strategy, results of operations, and financial condition.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. In addition, on a quarterly basis, certain members of our board of directors meet with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies and report back to the Audit Committee regarding the matters reviewed. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Audit Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Audit Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.

companyName: MongoDB, Inc.

ticker: MDB


text: We regularly conduct comprehensive cybersecurity risk assessments to identify vulnerabilities, threats and potential impacts on our business operations and stakeholders. We actively monitor and gather threat intelligence to stay informed about emerging cyber threats and vulnerabilities relevant to our industry and operations. We engage independent third-party assessors for periodic cybersecurity program assessments against industry accepted frameworks and to perform technical penetration assessments. We assess ourselves against the Center for Internet Security Top 18 controls framework, the National Institute of Standards and Technology Cybersecurity Framework, the Payment Card Industry Data Security Standard and management-defined technology controls to support our internal controls over financial reporting.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; and continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Management's Role Managing Risk Management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: 1847 Holdings LLC

ticker: LBRA


text: Risk Management and Strategy; Governance The Company maintains a documented Information Security Risk Management Program ("Program") that includes risk assessments regularly conducted by the Company and third-party experts, assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company's overall risk management system. The Program is informed by industry standards and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies.

companyName: American National Group Inc.

ticker: ANG-PD


text: Customer Data Privacy. The Bank maintains and publishes its Customer Data Privacy Principles on its official website. The Principles include disclosures of the use and sharing of certain customer information, as well as the significant restrictions the Bank places on such activities. In addition, the Bank maintains policies restricting the knowing use or collection of information about children under age 13 by the Bank, other than to provide parental notice or consent. The Bank also maintains policies and controls over the use of electronic mail solicitations, including a customer's ability to "opt-out" of electronic solicitations at any time.

companyName: BankFinancial CORP


text: While Bancorp has not experienced any cybersecurity incidents that have materially affected its operations, it acknowledges the potential impact such risks could have on business strategy, financial condition and operational resilience. The institution remains vigilant, continuously evaluating and enhancing its cybersecurity measures to preemptively address any potential risks that could impact its operations or financial condition in the future. This approach aligns with the institution's commitment to maintaining the trust and security of its stakeholders in an increasingly digital world.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: The cybersecurity team reports to the Chief Information Officer ("CIO") and in January 2024, we hired a Chief Information Security Officer ("CISO") with significant experience in leading cybersecurity teams to assume the leadership of management's responsibilities and governance discussed below.

companyName: Caesars Entertainment, Inc.

ticker: CZR