text: Roper performs cybersecurity risk assessments to assess compliance with mandated cybersecurity controls and to assess the likelihood and impact of specific cyberattacks. Cybersecurity risk assessments are periodically performed to assess the internal compliance with cybersecurity strategy and implementation of cybersecurity controls. Areas identified for enhancement and improvement are monitored and tracked to remediation by the Roper Cyber team, including the Vice President of Cybersecurity.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR

secItem: Item 1C


text: Third Party Cybersecurity Oversight We have implemented governance processes designed to monitor, evaluate, and mitigate security risks that may arise from a relationship with a third party vendor, partner, or customer. These security measures include: Vendor security assessments - Evaluating the cybersecurity protection that key vendors employ, prior to and during engagement. Insurance risk assessments - conducted by our insurance providers in order to evaluate cybersecurity related exposure. Operational Technology Security - Implementing security measures within some of our manufacturing facilities to enhance our cybersecurity protection. Secure customer data management - Solutions designed to safeguard customer data and critical systems.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Risks from Third Party Service Providers and Others Our cybersecurity team, under the oversight of the SVP, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations. Based on the results of these regular assessments (including assessments made before engaging a third party), we may decide to take action to address and mitigate certain risks or determine that the risk is not acceptable and terminate the relationship with the third party (or determine not to engage a third party).

companyName: E2open Parent Holdings, Inc.


text: We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Netcapital Inc.

ticker: NCPL


text: Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management programs and are based on recognized frameworks and other applicable standards. Our cybersecurity program has comprehensive processes for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. Our program has adopted and implemented an approach to identify and mitigate cybersecurity risks that include commercially reasonable technologies for companies with similar risk profiles.

companyName: Crane NXT, Co.

ticker: CXT


text: If a cybersecurity threat or incident is identified, the IRT will communicate the cybersecurity threat or incident and any damages to the CIEC. The CIEC will assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule and make a recommendation to the Board. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: Deutsche Bank Group's security incident management covers cybersecurity events that may affect it and its subsidiaries, its clients, business partners, or employees. The related management and reporting processes performed with the involvement of compliance, legal and data privacy are designed to enable a quick and effective response to cyberattacks and information security threats. Further, if DWS is notified of an incident, then a communication protocol will be followed to notify affected or potentially affected parties internal and external to DWS, including notification to us if our data or our stockholders data is at risk.

companyName: RREEF Property Trust, Inc.


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees Technology Risk Management. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Board Responsibilities Oversight of risks from cybersecurity threats is shared by the Board of Directors and the FAC. The FAC oversees our cybersecurity program. The ISO provides the FAC with an annual presentation on our cybersecurity program, emerging threats, and the state of LP's cybersecurity maturity. In addition, the ISO provides updates to the FAC no less often than quarterly with respect to materials regarding the cybersecurity program.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems for management of our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Our Board of Directors provides oversight over cybersecurity risk. Our Board of Directors receives and provides feedback on periodic updates from management regarding cybersecurity and is notified between such updates regarding significant new cybersecurity incidents, if any. Our Board of Directors also receives periodic briefings on cyber-related issues and accomplishments including, among other things, reviewing key elements of our cybersecurity program, ongoing training initiatives and awareness programs, occurrence of any incidents, and updates regarding third-party certifications and assessments.

companyName: TechTarget Holdings Inc.


text: Signet's cybersecurity program is run by our CISO, who is the head of the Company's cybersecurity team, and who reports to Signet's Chief Information Officer ("CIO"). The CISO is responsible for assessing and managing Signet's cybersecurity risk management program, regularly informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position with Signet since 2018, was previously CISO at multiple Fortune 500 retail and hospitality organizations and held senior cybersecurity management roles in the financial services industry. The Signet cybersecurity team supporting the CISO has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Signet. In addition, a cross-functional management committee has been established to assess cybersecurity breaches, should they occur, to determine whether a breach is material and requires disclosure.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over twenty-five years of IT and cybersecurity experience, has served over fifteen years in various cybersecurity management roles, and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CISO is a part of, and is supported by, our IT security team, which includes other security leaders, security engineers, and security analysts. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.

companyName: CINTAS CORP

ticker: CTAS


text: We believe that cybersecurity and the protection of data and customer information in our possession, custody or control is of paramount importance to our business. We have therefore designed and implemented a framework of policies, programs and procedures (the "Information Security Program") intended to protect the confidentiality, integrity, and availability of our critical systems and information, including customer information. The Information Security Program is informed by interagency guidance issued by banking regulators as well as the FFIEC Information Security Booklet and Cybersecurity Assessment Tool. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the guidance to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: First Internet Bancorp

ticker: INBK


text: Management also provides the Audit Committee with an annual overview of Kforce's various lines of insurance that we maintain, including our cybersecurity insurance policy. The Audit Committee provides the Board with quarterly reports on the Firm's risks and ERM program findings, including cybersecurity risk and data privacy practices.

companyName: KFORCE INC

ticker: KFRC


text: We continually review and seek enhancements to our cybersecurity programs and processes. The ISP is periodically reviewed by internal Company stakeholders and modified to respond to changing cybersecurity threats and conditions. We regularly test our layered defenses by performing simulations and tabletop exercises (including at a management level) and drills at both a technical level (including through penetration tests) and by review of our information security policies, practices and procedures with third-party consultants. Our ISP team monitors alerts and meets with business managers to discuss threat levels, emerging threats or trends, and available mitigation or remediation approaches and tools. The team also regularly collects and communicates to management relevant data on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: In the future we may be required to expend additional resources to continue to enhance information security measures to investigate and remediate any information security vulnerabilities. We can provide no assurance that the measures we have implemented to prevent security breaches and cyber incidents will be effective in the event of a cyber-attack. Our Directors do not have enough expertise to monitor and manage such risks and will need to rely upon others to help us stay vigilant, process, report, and remediate any incidents.

companyName: ECO SCIENCE SOLUTIONS, INC.

ticker: ESSI


text: As a smaller company, we do not have any significant operations and our sole business activity is licensing our technology. However, because we have cash and investments in our bank and brokerage accounts and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As a smaller company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents during the years ended December 31, 2023 and 2022.

companyName: MANHATTAN SCIENTIFICS INC


text: The Audit & Risk Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of properly handling and protecting Company, employee, and third-party data, including through annual privacy and security training to enhance employee awareness of how to recognize, detect, and respond to cybersecurity threats. In addition to the annual training requirements, we regularly send employees mock phishing emails to test their ability to assess incoming email threats.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We manage material risks from cybersecurity threats to our information systems and the information residing in our information systems through various processes and procedures, including, depending on the environment, risk assessment, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We engage third-party service providers to provide some of the resources used in our information systems and some third-party service providers have access to information residing in our information systems. With respect to such third parties, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.

companyName: EvoAir Holdings Inc.

ticker: EVOH


text: protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our board of directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Executive Officer ("CEO"), and Director of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our Director of Information Technology reports directly to the Chief Executive Officer of ImprimisRx and Chief Commercial Officer, who reports directly to our CEO.

companyName: HARROW, INC.

ticker: HROW


text: Cybersecurity is an important part of our risk management program for our Board of Directors and management. Our Board of Directors, through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management program, including cybersecurity matters.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: We face a number of cybersecurity risks in connection with our business. From time-to-time, we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations, and financial condition.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee ("ERC"). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer ("CIO"). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: We have a Technology Committee, which reviews and discusses all technology-related methodologies and initiatives related to information technology and cybersecurity, among other topics. The Technology Committee is a management committee and reports to the Strategic Operations Management Committee (SOMC). We also have an Operations Risk Committee (ORC), which is a management committee, and is the secondary venue for reviewing enterprise security initiatives. The ORC also serves as the primary governance venue for the Business Resiliency Management Program and escalates business resiliency concerns and risk issues, among other matters, to the Strategic Risk Management Committee (SRMC). The ORC, is responsible for annually reviewing and providing recommendations on FHLBank's Security Incident Response Plan and receives monthly updates on the Enterprise Security Program. The ISO is a required member of both the Technology Committee and the ORC.

companyName: Federal Home Loan Bank of Topeka


text: Management Oversight Our management plays an active role in assessing and managing the risks posed to us by cybersecurity threats. Our strategy for managing cybersecurity risk is embedded within the IT function, which reports to our Chief of Business Operations (CBO) and our Information Security function, which reports to our CRO. The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Global Chief Information Officer (CIO) and our Global Head of Information Security (GHIS). Our CIO has over 24 years of experience in the area of information technology. He previously served in related roles, including IT strategy and delivery roles at Arthur Andersen Consulting and Deloitte Consulting, and has served in his current role since joining us in 2017. Our GHIS has over 18 years of information security experience. His experience includes driving our information security strategy, awareness and training, third party cyber risk management, compliance, and providing assurance of the security activities conducted by the IT Security Operations team. He has served in his current role since joining us in 2006. Our CIO and GHIS are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.

companyName: Enstar Group LTD


text: Physical controls are designed to work in conjunction with digital and cybersecurity controls to help protect the Company's IT and OT assets from physical threats. Our Chief Security Officer is responsible for a physical security program including site plans, cameras, security systems monitoring, and access control and badging systems to manage physical security risks.

companyName: CONOCOPHILLIPS

ticker: COP


text: We seek to detect and investigate suspected attacks against our network, products, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we still remain potentially vulnerable to known or unknown threats. Our cyber incident response plan includes an escalation process if a cybersecurity incident meets specific rating criteria to trigger action designed to minimize potential disruptions and protect the integrity of our operations. The cyber incident response plan has been reviewed by external experts and is reviewed internally annually. We also conduct periodic cybersecurity tabletop exercises where we perform walkthroughs of cyber incident scenarios with senior management to test and enhance preparedness.

companyName: SYSCO CORP

ticker: SYY


text: The Company has cybersecurity capability including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes. The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss. As part of the Company's holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.

companyName: Garrett Motion Inc.

ticker: GTX


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted with cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: Our Board holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. Members of the Board receive updates on a quarterly basis from senior management and the Executive Compliance Committee, including the reporting of emerging or existing cybersecurity risks, mitigation strategies employed to manage these risks, any cybersecurity and data privacy incidents, and status on key information security initiatives. In addition, our SVP of IT annually provides an overview of our information security program to the Board, including a summary of key performance indicators.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Director of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Role of Management The Chief Information Officer oversees the activities of our IT and information security teams. Our Chief Information Officer has been with Paycom since 2005 and has more than 30 years of IT and software development experience. The Vice President of IT and Information Security, who reports to our Chief Information Officer, is responsible for ensuring that both new implementations and ongoing operations comply with the policies, procedures, and guidelines of our information security program. Our Vice President of IT and Information Security has been with Paycom for over a decade and has worked in technology development, improvement, infrastructure, and security for over 15 years. The Vice President of IT and Information Security is supported by our Director of IT Security, who has worked in technology development, improvement, infrastructure, and security for over a decade. The Director of IT Security is responsible for the growth and implementation of the information security and data privacy programs and oversees the operations of the information security team. The Director of IT Security also provides oversight for information security and privacy policies and controls, oversees compliance activities, and provides metrics and guidance to executive management regarding the program. The aforementioned leaders and teams have a breadth of experience and manage programs related to governance, risk, and compliance; data privacy and security; vulnerability management; security operations; and application security.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Information leaks: If data is taken from databases or other sources due to unauthorized access or internal crime, the Company's credibility will be lost, resulting in a loss of profits or the occurrence of compensation for damages.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CSO. The CSAB is currently comprised of three external members with a range of executive national and international expertise in areas such as aviation and transportation security, physical security operations, cyber security, and privacy and data security. The CSAB meets in-person, together with management of the Company, at least annually, in addition to quarterly meetings by phone. The CSAB reports annually to our Board or our Audit Committee, and is an available resource to both management and members of the Board at any time.

companyName: Clear Secure, Inc.

ticker: YOU


text: Engagement of Consultants for Risk Management Services Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts to perform a variety of functions for the Company. These include, but are not limited to, cybermaturity audits, targeted ransomware assessment and table-top exercises, red and purple team attack simulations, internal penetration tests and other internal and external audits. These partnerships enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect, our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition which are further discussed in Item 1A. "Risk Factors—Risks Related to our Industry, Business and Operations—We and our third-party service providers rely on numerous technology systems and any business interruption, security breach, or system failure could negatively impact our business and profitability" of this Annual Report on Form 10-K, which should be read in conjunction with the information in this section.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: We recognize the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: We have not experienced a material cybersecurity breach and no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our Company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A. Risk Factors.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Our information technology personnel and our senior management lead the operational oversight of the company-wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: We are integrating our information security programs and cybersecurity risk management processes into our overall enterprise risk management ("ERM") strategy. We are developing an entity-wide information technology ERM framework and will take steps to monitor, report on and communicate to stakeholders consistent with our ERM strategy. Recognizing the cybersecurity risk landscape is complex and ever evolving, we engage with a broad group of external experts and consultants, and auditors in evaluating and testing our information security programs. We leverage this specialized expertise to manage threat detection and response management, conduct regular audits and consult on our overall information security programs.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased IT security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: In addition, our CIO, who has more than 25 years of industry experience and over 10 years of experience with the development, training and controls of effective enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: Regarding data privacy, in 2023, our Ethics & Compliance function implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: Rimini Street, Inc.

ticker: RMNI


text: The Company has implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to the Company's internal information systems and its services. The Board of Directors has direct oversight of the Company's risk management process and the management of cybersecurity risks. Under the direction and supervision of the Company's Chief Financial Officer, the Company conducts periodic risk assessments, which include cybersecurity risks. Management provides a comprehensive update to the Board of Directors on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: We employ a multi-layered approach to data security and data privacy. This approach begins with our information security program, which leverages the National Institute of Standards and Technology Cybersecurity Framework. Our program includes policies and standards that delineate requirements for the implementation and on-going maintenance of our information systems as well as security responsibilities for all personnel. We review these policies and standards periodically and update as needed. We have processes to oversee the maintenance and enforcement of our information security policies and educate personnel on their responsibilities. We maintain a "defense-in-depth" model, which employs multiple layers of protection for the Company. Among other things, we perform external and internal risk assessments, penetration testing, vulnerability scanning, secure code development and monthly security awareness training (including phishing awareness tests) for all personnel.

companyName: Enact Holdings, Inc.

ticker: ACT


text: The Company's Board of Directors is aware of the impact of potential cybersecurity threats and stays in close contact with management in case a threat is identified.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: The Senior Vice President of Information Technology supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Director of Information Technology, in coordination with compliance and human resources, conducts at least annual and ongoing company-wide information security awareness training. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during vendor onboarding, the inclusion of protective provisions in vendor agreements, and risk-based monitoring of vendors on an ongoing basis.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: The board of directors receives regular reports from management concerning our cybersecurity risk management program. The board also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: The Company engages a third-party service provider specializing in information technology, which assists with the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: 22nd Century Group, Inc.

ticker: XXII


text: The Company's Director of Cybersecurity in cooperation with the Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Company's internal Cybersecurity Steering Committee. Our Director of Cybersecurity has over 20 years of experience leading cybersecurity oversight and holds cybersecurity certifications such as the CISSP ("Certified Information Systems Security Professional").

companyName: Workhorse Group Inc.

ticker: WKHS


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, plan to engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: Ondas Inc.

ticker: ONDS


text: The Company's cybersecurity risk management processes incorporate multiple layers of security to help identify and protect against cybersecurity threats including a dedicated cybersecurity team, technical security controls, policy enforcement, monitoring systems, employee training, contractual arrangements and management oversight. Given the dynamic nature of the cyber-threat environment, the Company engages with third-party assessors, consultants and others from time to time on various cyber-related matters, including assessing, enhancing, advising and monitoring the Company's cybersecurity risk management process.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Champion Homes, Inc.

ticker: SKY


text: In line with cyber risk management best practices, we have collaborated with recognized third-party experts as needed to align the CRM's foundational processes, metrics, monitoring, and reporting with common frameworks such as the NIST RMF and the NIST CSF.

companyName: KROGER CO

ticker: KR


text: We utilize third-party service providers for a variety of functions. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. We look for reliable and reputable service providers that maintain cybersecurity programs based on industry standards. Depending on the nature of the services provided and the sensitivity of information processed, our vendor management process may include contractually imposed obligations on the provider and reviewing the cybersecurity practices of such provider.

companyName: CENTERSPACE

ticker: CSR


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • evaluations of our readiness to assess, respond and, as applicable, recover from potential cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity training to educate our employees (including senior management and incident response personnel), consultants, and other users about their individual responsibilities regarding protecting our IT systems and data; • a third-party risk management process for service providers, suppliers and vendors who have access to our critical systems and information.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Board members receive presentations on cybersecurity topics from our Chief Information Officer ("CIO").

companyName: Viant Technology Inc.

ticker: DSP


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 13 years of IT security experience in regulated industries such as government, energy and biopharma. He has over 20 years of combined IT experience.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Registrant expects to continue to increase its investment in information technology to monitor and address cyber threats and attempted cyber-attacks, and to improve its posture in addressing security vulnerabilities. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Allakos Inc.


text: The Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our information technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.

companyName: CORPAY, INC.

ticker: CPAY


text: Material Cybersecurity Risks, Threats, and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Southern Company system, including its business strategy, results of operations, or financial condition. While the Southern Company system has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats, or incidents. Additional information on cybersecurity risks can be found in Item 1A "Risk Factors" of this Form 10-K which should be read in conjunction with the foregoing information.

companyName: SOUTHERN CO GAS


text: We currently engage a qualified IT consultant who reports to our Chief Executive Officer. This consultant has over 30 years of experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: Our cybersecurity program of technical, administrative, and physical controls is intended to reduce the risk of cyber threats and protect our information, as well as document processes to determine and make appropriate disclosures regarding potential material threats and incidents. Our cybersecurity philosophy and approach align to the National Institute of Standards and Technology Cybersecurity Framework and its core elements to govern, identify, protect, detect, respond, and recover from the various forms of cyber threats. Our practices include, but are not limited to, cybersecurity protocols and controls, system monitoring and detection, communication of incidents to appropriate management, third-party risk management, including assessments of emerging threats and vulnerabilities, and ongoing privacy and cybersecurity training for employees and contractors concerning cyber risk. A foundational element of our cybersecurity risk management processes is the annual Cybersecurity and Information Security Risk Assessment (CSRA), which includes an analysis of cybersecurity risks facing us and associated recommendations and action items to mitigate identified risks. We periodically utilize third parties to assess the effectiveness of our cybersecurity efforts through independent validations, verifications, and security assessments.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: Howmet has implemented a multi-faceted cybersecurity risk management framework, which includes progressing toward achievement of the Cybersecurity Maturity Model Certification to certify the Company's compliance with certain cybersecurity standards published by the National Institute of Standards and Technology. We deploy and operate preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. Our approach includes conducting internal vulnerability assessments, external penetration testing and attack simulation. In addition, the Company subscribes to third-party managed security service providers that continuously monitor the Company's systems to assist with early cybersecurity threat detection and protection. Howmet conducts cybersecurity risk assessments of key vendors and other counterparties for any potential risks. Risk-based action plans are further developed to take into account evolving threats, which result in recommendations for new protocols and infrastructure. The Company has a robust program of employee education on the prevention of unauthorized access to Company information and systems.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Alternus board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. Alternus's Chief Information Officer (CIO)

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: We manage our cybersecurity risk as an integral part of our enterprise risk management programs. Accordingly, you should review the disclosure in this Item 1C in conjunction with the disclosure in the Risk Management section of this Report.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Despite our efforts to prevent cybersecurity threats and incidents, our systems may be affected by damage or interruption resulting from, among other causes, cyber attacks, security breaches, power outages, system failures or malware (including ransomware and other programs that operate with malicious intent). Disruptions to these systems may impair our ability to conduct business and have a material adverse effect on our business, results of operations and financial condition. Despite the security measures we have in place, our facilities and systems, and those of third parties we rely on or do business with, may be vulnerable to cyber attacks, security breaches, malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors or other similar events or disruptions. Any such event involving the misappropriation, loss or other unauthorized disclosure of information, whether impacting us or third parties we rely on or do business with, could result in losses, damage our reputation or relationships with customers and suppliers, expose us to the risks of litigation, regulatory action and liability, disrupt our operations and have a material adverse effect on our business, results of operations and financial condition.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: We have relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.

companyName: W. P. Carey Inc.

ticker: WPC


text: Our policies require each of our employees and crew members to contribute to our data security efforts. We regularly educate our employees about the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Information Technology, Cybersecurity and Data Protection— Failure to maintain the security of our information and technology networks, including personal information and other client information, intellectual property and proprietary business information could materially adversely affect us." Board of Directors has oversight of the Company's cybersecurity program.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: We engage in the periodic assessment and testing of our policies, standards, process es and practices that are designed to identify vulnerabilities and weaknesses, address cybersecurity threats and test its readiness to respond to cyber security incidents. These efforts include a wide range of activities, including threat modeling, a variety of vulnerability and configuration scans, penetration testing, audits, tabletop exercises and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness and penetration tests. The results of such assessments, audits and reviews are reported to the Cybersecurity Committee and our board of directors and to our management, and we adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. Insurance: We maintain information security risk insurance coverage.

companyName: Fortinet, Inc.

ticker: FTNT


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our Privacy and Security Officer works with Information Technology, Legal, and other NeuroPace leadership to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: NeuroPace Inc

ticker: NPCE


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: Our Chief Risk Officer ("CRO") periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CRO on our cybersecurity risks, including briefings on our cyber risk management program. A potentially material cybersecurity incident would be immediately reported to the Audit Committee and management would continue to brief the Audit Committee on management's response to the cybersecurity incident. Audit Committee members also receive periodic presentations on cybersecurity topics from our CRO, supported by our information technology staff, or external experts as part of the Board 's continuing education on topics that may affect public companies.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: The information technology systems we rely upon to effectively manage our business data, communications, supply chain, fulfillment, and other business processes are subject to risk from security breaches and other significant disruptions. Such breaches and disruptions may occur through breaches by our personnel or by intrusions over the internet, malware, computer viruses, attachments to e-mails or by persons with whom we have commercial relationships. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Item 1A. Risk Factors— We are subject to cyber security risks and may incur increasing costs in an effort to minimize those risks".

companyName: Freshpet, Inc.

ticker: FRPT


text: AFG continues to integrate assessing cybersecurity threat risks associated with its use of third-party service providers, generally at the initial engagement or renewal of the relationship. When conducting these assessments, AFG's Enterprise Information Security Group ("EISG") considers the risk profile of the vendor or supplier, assesses security controls with the third parties and engages in contractual review to ensure appropriate security controls are in place.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes. We also engage third-party cybersecurity consultants to help us oversee cybersecurity threats both internally and in relation to our third-party service providers, including in connection with the foregoing activities. Our third-party cybersecurity consultants work to mitigate cybersecurity risks by executing all-inclusive security procedures, including but not limited to continuous employee education and training, assessing risks, monitoring systems, implementing security controls, and responding to incidents. This is done in a variety of manners including assessing the strength of outside vendors, suppliers and business partners that may have access to the Company's data and systems, setting up strong access controls in the form of firewalls and encryption, continuous monitoring of data for suspicious activity and other threats, security audits and extensive training.

companyName: Journey Medical Corp

ticker: DERM


text: We describe whether and how risks from cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "WE RELY HEAVILY ON INFORMATION TECHNOLOGY. ANY INTERRUPTION OR LAPSE RELATED TO THAT TECHNOLOGY, INCLUDING ANY CYBERSECURITY INCIDENTS, COULD HARM OUR ABILITY TO OPERATE OUR BUSINESS EFFECTIVELY." included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Balance Labs, Inc.

ticker: BLNC


text: In addition, the Company's information security/cybersecurity program is managed by the Director of Infrastructure and Security, who is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Infrastructure and Security and Chief Information Officer provide periodic reports to our Board and Audit Committee as well as our Chief Executive Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. The Incident Response Team, which includes the Chief Information Officer, Director of Infrastructure and Security, Chief Financial Officer and key operational leaders, is regularly engaged to discuss cybersecurity risks and to review the Company's preparations for any security events. The Incident Response Team will notify the Board of Directors of any critical events as defined in the Incident Response Plan. Additionally, the Chief Information Officer regularly engages the Board representative with cybersecurity experience to identify Board-level needs for education and communication.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Technical Safeguards We implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through quarterly vulnerability assessments and cybersecurity threat intelligence, as well as outside periodic audits and certifications.

companyName: Eiger BioPharmaceuticals, Inc.


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility, including Nicolai A. Brune our Chief Financial Officer and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. The Audit Committee and management have engaged a third-party firm to oversee the complete audit of our cybersecurity and risk management systems to ensure the integrity of the systems that are in place.

companyName: RenX Enterprises Corp.

ticker: RENX


text: The VP of IT has served in various leadership roles in information technology and information security for over 25 years, including leading the cybersecurity programs for three public companies. The VP of IT holds undergraduate and graduate degrees in business and has attained multiple cybersecurity certifications including Certified Information Security Manager and Data Privacy.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes, and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.

companyName: KELLY SERVICES INC

ticker: KELYA


text: Our Chief Information Security Officer ("CISO"), in coordination with our Chief Technology Officer, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 25 years of experience managing robust security programs, including in heavily regulated environments such as financial services. The CISO possesses extensive experience in information security, risk management, and technology governance, with a strong background in both strategic leadership and technical security operations. The CISO presents to the Risk Management and Compliance Committee on a bi-annual basis concerning our cybersecurity program.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: In addition, a management-level Safety and Security Council ("Council") chaired by our CEO and comprised of our CSO, General Counsel, and other senior officers, provides cross-functional coordination for the management of the Company's security functions. The Council receives information, typically monthly, on the status of the cybersecurity program, initiatives, incidents, cybersecurity risks, assessments, and threats, among other items. The Chair of the Board's Cybersecurity Committee is the Board's liaison to the Council and attends the regular meetings of the Council.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which is used along with a risk-based approach to plan and implement changes or improvements to the security environment. The Company has engaged independent experts to assess the security environment for potential vulnerabilities or weaknesses and has plans for future engagements periodically to supplement the expertise and processes established within the Company. Thorough updates are provided to the board of directors quarterly by the Vice President, Information Technology (IT) Operations and Security. The directors may ask questions or engage in further discussion related to the security environment.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Cybersecurity Incident Response Process We maintain and actively update our Cybersecurity Incident Response Plan to triage, contain, and mitigate any issues as quickly as possible. Our Cybersecurity Incident Response Plan includes steps to analyze, and as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on the type and severity of the specific incident. Our Cybersecurity Incident Response Policy ensures that our CIO, and, as appropriate, our senior management team, members of our legal staff and outside legal counsel, our disclosure committee, and members of our Audit Committee or Board of Directors are timely informed of and consulted regarding cyber incidents.

companyName: GMS Inc.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors may from time to time experience threats and security incidents that could affect our information or systems. See Item 1A "Risk Factors" in this Annual Report on Form 10-K for more information.

companyName: Phreesia, Inc.

ticker: PHR


text: The Company's Chief Financial Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board and the audit committee. Our Chief Financial Officer works with our broader IT security team, including our specialty IT advisor. Our specialty IT advisor has over 25 years of experience leading technology oversight, and others on its IT security team have cybersecurity experience or certifications.

companyName: Perception Capital Corp. IV


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: LENSAR, Inc.

ticker: LNSR


text: Hines' CISO and CTO are principally responsible for overseeing the cybersecurity risk management program, in partnership with other Hines leaders. The CISO has more than 30 years' experience in the IT industry, with over 20 years spent working with cybersecurity design and implementation, as well as infrastructure, audit, design, operation, and as the head of Hines' IT security and compliance practice. The CTO previously served as both Director and Vice President of Information Technology at Hines and has led several Hines technology implementations and strategic developments of proprietary applications and infrastructure.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response strategy, incident detection and response measures, a vulnerability management policy, risk assessments, encryption of certain data, network security controls, data segregation, access controls, physical security controls, systems monitoring controls, personnel training, penetration testing, cybersecurity insurance, dedicated cybersecurity personnel, background checks for certain personnel, vendor management strategies, and asset management strategy (such as tracking and disposal of Company information systems).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our CISO has over 20 years of experience in cybersecurity. Before joining the Company in 2023, he held senior leadership positions in cybersecurity and security operations at publicly traded companies, a federally funded research and development center and the U.S. military. He holds a B.A. in Political Science from the University of Arizona and an MA in Strategic Intelligence from American Military University. He is also a Certified Information Systems Security Professional. Our CIO has been with the Company since 2017. She has over 20 years of experience in senior technology and financial roles in the asset management and financial services sector. She holds a B.S. in Accounting from Babson College and an MBA from Indiana University.

companyName: StoneX Group Inc.

ticker: SNEX


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The personnel comprising our internal security committee are certified and experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.

companyName: Zscaler, Inc.

ticker: ZS


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Our Board of Directors and Executive Officer Committee have delegated oversight authority to a management-level IT/Operations Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise. The IT/Operations Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience. The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats. This information is subsequently reported up to the Board Risk Committee.

companyName: SIERRA BANCORP

ticker: BSRR


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, our Head of Resource Management, Director of IT, and CCO consult with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • restrict access to known devices only; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has 20-plus years of experience in the cybersecurity industry. Our CIO is informed of such incidents through the Infrastructure and Security Team. Our CIO reports directly to the Company's Chief Financial Officer and reports information on these risks and incidents to the Board and the Audit Committee. Additionally, our CIO meets monthly with TriMas Senior Leadership in the Security Incident Management and Mitigation meetings.

companyName: TRIMAS CORP

ticker: TRS


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, operational personnel, and members of the Board of Directors.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Cybersecurity is a material part of the Company's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity events which have had a material effect (or are reasonably likely to have a material effect) on the Company's business strategy, results of operations, or financial condition. Notwithstanding, the impact of a cyber-incident could have a future impact on the Company's results of operations or financial condition. Cyber-attacks or other security breaches could adversely affect our operations, net income, or reputation.

companyName: William Penn Bancorporation


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Our Cybersecurity team has extensive years of collective experience and members hold multiple certifications, including CISSP, CCNP, CISA, and CySA+.

companyName: Vista Outdoor Inc.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations. However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. See Item 1A. Risk Factors under, "We rely on the proper function, security and availability of our information technology systems and data, as well as those of third parties throughout our global supply chain and our customer and payor base, to operate our business, and a breach, cyber-attack or other disruption to these systems or data could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position."

companyName: Medtronic plc

ticker: MDT


text: The readiness of the incident response team is promoted through table-top exercises and threat simulations. The Company also conducts mandatory training of all employees on its security practices and policies and periodically sends simulated phishing emails to employees to build resilience.

companyName: BLACKBERRY Ltd

ticker: BB


text: Overseeing Third-Party Risk. Because we are aware of the risks associated with engaging third-party service providers, the Company has implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our Director of Infrastructure and Cybersecurity.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Documentation and Reporting We maintain detailed records of our third-party assessments and any information or documentation that is provided during the assessment process. We regularly review and report on third-party risk management activities and any significant issues to senior management and/or our Audit Committee.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Validating solution and program effectiveness in relation to regulatory compliance and industry standards is important. Accordingly, the Company engages third-party consultants and independent auditors to conduct penetration tests, external audits, program enhancement where applicable and review of cybersecurity risk assessments.

companyName: BV Financial, Inc.

ticker: BVFL


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its Chief Compliance Officer, Chief Operating Officer, Chief Credit Officer, President & Co-Portfolio Manager, Chief Financial Officer of Management Company and Chief Financial Officer of Investment Funds, who acts as chairperson of the ORC. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses, and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. The company engages consultants, auditors, and other third parties to identify and manage risk from third parties.

companyName: FLOWERS FOODS INC

ticker: FLO


text: QNB maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, QNB's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the QNB's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: QNB CORP.

ticker: QNBC


text: Cybersecurity awareness training for users and senior management, including through the use of third-party cybersecurity incident response plan that includes procedures for responding to cybersecurity risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.

companyName: VPR Brands, LP.

ticker: VPRB


text: Because cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company's risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program: • Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the interim Chief Information Officer ("CIO"). The Cybersecurity and Risk Management Team is overseen by: (i) the Executive Committee, which consists of, among others, the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program. • Materiality Committee, which is led by the interim CIO, Controller and Chief Accounting Officer, and SVP, Assistant General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company's business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit Committee. • Audit Committee, which is comprised of independent directors, oversees the Cybersecurity and Risk Management Team and the team's implementation of its Cybersecurity Risk Management Program. The Audit Committee receives quarterly updates regarding cybersecurity risks and/or policy. In addition, the Materiality Committee updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. • Disclosure Committee, which is led by the Chief Legal Officer and Chief Financial Officer. The Disclosure Committee is informed of potentially material threats and incidents by the Cybersecurity and Risk Management Team and Materiality Committee and the Disclosure Committee is responsible for the preparation, review and filing of any disclosure required by applicable law.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: All companies utilizing technology are subject to threats of breaches of cybersecurity. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make proactive and strategic investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are imbedded into our overall risk management governance and are reviewed at least annually by the Audit Committee of our board of directors.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: We, under the oversight of our Audit Committee, have implemented and maintain an enterprise risk management program that encompasses cybersecurity risk management and is designed to identify, assess and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is informed by, and incorporates elements of, recognized industry standards and frameworks, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our program includes controls and procedures designed to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents, if any, in a timely manner.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program. To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Company's Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats. Our senior management is responsible for the day-to-day management of the material risks we face. Our VP Of Information System is scheduled to report to the CFO on a weekly basis and the Audit Committee on a quarterly basis on cybersecurity matters to include updates on cybersecurity threat management, strategy processes, system updates and cybersecurity risks activities, including but not limited to any recent cybersecurity incidents and related responses. Our Board is also engaged in discussion with senior management and the Audit Committee on at least a quarterly basis to discuss any updates to our cybersecurity risk management and strategy program. Each member of our Board has a working knowledge and/or experience with cybersecurity, IT strategy and IT risk assessment.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: Training and preparation are essential to the overall success of the CIMT to help ensure team members develop and maintain the operational, technical and managerial skillsets necessary to support the effective function of the CIMT. Our CIMT members undergo training and preparation for cybersecurity incidents like participating in regular cybersecurity incident response tabletop exercises and reviewing lessons learned. Our general cybersecurity team receives extensive on-the-job training with respect to cybersecurity operations, maintenance, analysis, detection, investigation, mitigation and protection. In addition, company-wide cybersecurity and insider threat training is mandated for our employees.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: Currently, we have not identified any risks stemming from known cybersecurity threats, including those resulting from previous cybersecurity incidents, which have significantly impacted our operations, business strategy, financial condition or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company's business. See " Risk Factors – Operational Risks to the Company and Our Business. "

companyName: ESCALADE INC

ticker: ESCA


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including guest information.

companyName: Hyatt Hotels Corp

ticker: H


text: To foster an enterprise-wide approach to risk management, we have established an ERSC chaired by our CEO and comprised of a cross-functional group of senior leaders from across our organization. The ERSC regularly reviews key risk areas and oversees the development and implementation of effective compliance and risk management practices, including the use of internal and external audits. Our Board of Directors and the AOC receive reports regarding the same. Governance of our cybersecurity risk management program is overseen by the ERSC, along with steering committees for information security, operational technology security, third-party vendor security controls, Sarbanes-Oxley security controls, and North American Electric Reliability Corporation Critical Infrastructure Protection compliance.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Our risk management framework is designed to identify, assess, and mitigate potential threats that may impact the achievement of our business objectives. We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Yext, Inc.

ticker: YEXT


text: With respect to incident response, we maintain a global incident and breach response program coordinated by our Chief Cybersecurity and Technology Risk Officer and our Chief Ethics and Compliance Officer. Our incident and breach response program follows requirements of applicable laws and recognized frameworks, such as those established by ISO and the U.S. National Institute of Standards and Technology, and applies a risk-based approach across six phases comprised of (i) preparation, (ii) detection, (iii) reporting and escalation, (iv) analysis and evaluation, (v) response, and (vi) post-incident activities.

companyName: Dun & Bradstreet Holdings, Inc.