text: Incident Management Plan Our cybersecurity policy includes an incident management plan ("IMP"), which consists of the following processes: • The development, documentation, review and testing of security procedures and incident management procedures, which are regularly re-assessed, updated and tested; • The FRS Committee reviews any identified matters by assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The FRS Committee notifies the Board of Directors and the Audit Committee; • The FRS Committee consults with outside experts, if determined that the incident rises to a significant level; • The FRS Committee initiates containment by making tactical changes to the computing environment to mitigate active threats based on currently known information; • The FRS Committee establishes the root cause of incidents, identification and evidence collection from all affected machines and logs sources, threat intelligence and other information sources; • IT personnel recovers and restores normal business functionality, which includes the reversal of any damage caused by the incident and responding as needed; and • The FRS Committee reviews the closure of each incident and conducts a "lessons learned" analysis to improve prevention and ensure the IMP and cybersecurity plans are more efficient and effective.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to help support the effectiveness of our systems and our preparedness for cybersecurity risks. Our program is informed by industry frameworks, such as the NIST Cybersecurity Framework, and comprises various components, including policies, procedures and protocols; threat monitoring and alerting; auditing and assessments; and other security controls and tools. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors.

companyName: GRAIL, Inc.

ticker: GRAL

secItem: Item 1C


text: We consider the protection of our customers' and corporate data to be a priority within our business. We continually monitor and assess the cybersecurity landscape and invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Through these partnerships, we incorporate threat intelligence, security operations, continuous training, and penetration testing. We strive to reduce the threat landscape for both the Company and our customers, through vigilantly monitoring systems and general technology controls.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see the section entitled "Risks Related to Our Business Operations and Industry" in Item 1A of this Annual Report.

companyName: PTC INC.

ticker: PTC


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. The Company maintains a variety of incident response plans that would be deployed in the event that a cybersecurity incident were detected. We require all of our employees to undertake data protection and cybersecurity training and compliance programs on an annual basis, which are administered and tracked through online learning modules.

companyName: TransMontaigne Partners LLC


text: We define information security and cybersecurity risk as the risk that the confidentiality, integrity or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification or destruction. Information security and cybersecurity risk is an operational risk that is measured and managed as part of our operational risk framework. Operational risk is incorporated into our comprehensive Enterprise Risk Management (ERM) program, which we use to identify, aggregate, monitor, report and manage risks. For more information on our ERM program, see "Risk Management" under "MD&A."

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our critical systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes periodic audits, threat assessments, and consultation on security enhancements.

companyName: Castellum, Inc.

ticker: CTM


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards to mitigate such risks. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures.

companyName: AGILYSYS INC

ticker: AGYS


text: We are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation. We recognize the importance of developing, implementing, and maintaining comprehensive cybersecurity measures as part of our larger risk management program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team works closely with our Business Technology and Information Security ("InfoSec") departments to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our information security program incorporates data encryption and access control, single sign-on and multi-factor authentication, vulnerability management, and malware protection for both laptops and servers. We align with industry standards and frameworks, and we maintain FedRAMP Moderate authorization, an ISO 27001 certificate, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. There can be no guarantee that, in every instance, our policies and procedures will be properly followed or that those policies and procedures will prevent malicious or unauthorized access to our information systems.

companyName: WORKIVA INC

ticker: WK


text: Monthly, the Board of Directors receives an IT status dashboard which includes, among other things, IT security metrics regarding phish-training and vulnerability management.

companyName: Federal Home Loan Bank of Dallas


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence. Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities. The Board of Directors receives an update on our risk management process and the risk trends related to cybersecurity at least annually. Additionally, on a quarterly basis, the Audit Committee will receive updates from Management on cybersecurity.

companyName: ENCISION INC

ticker: ECIA


text: We believe cybersecurity is critical to advancing our technological advancements. As an esports company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Mobile Global Esports, Inc.

ticker: MGAM


text: We maintain established information security policies and processes; deploy regular network and endpoint software updates on all company-managed systems and workstations to detect and prevent, among others, viruses, malicious code, unauthorized access, and phishing attempts; maintain a disaster recovery plan, and perform at least two disaster recovery exercises annually to validate and optimize our recovery efforts in event of a cybersecurity incident; and regularly engage third-party cybersecurity experts to conduct vulnerability assessments and penetration testing on our information networks, systems, and applications.

companyName: TORO CO

ticker: TTC


text: Our chief technology officer, with 13 years of experience in information technology, artificial intelligence and software engineering, is responsible for managing and assessing risks related to cybersecurity and data governance. Our chief technology officer supervises our vice-president of information technology, who has primary operational responsibility for managing the overall cybersecurity posture and strategy, managing internal and external cybersecurity resources and organizing and leading efforts to prevent, detect and respond to cybersecurity incidents and threats. Prior to joining the company, our chief technology officer has previously served in various data and technology leadership roles, including most recently as chief data officer at another biotechnology company. Our vice-president of information technology has 25 years of experience in information technology and most recently served as senior director of information technology operations and infrastructure at another biotechnology company. As part of our quarterly disclosure committee process, our chief technology officer discusses with our chief executive officer, interim chief financial officer and other executive team members any significant cybersecurity issues, including any potential risks related to cybersecurity incidents.

companyName: COMPASS Pathways plc

ticker: CMPS


text: We have implemented processes to identify and assess the cybersecurity threats that could affect our business and information systems and we use various tools and methodologies to test our cybersecurity defenses on a regular basis. As part of this process, we perform regular vulnerability scans and penetration tests and engage third party experts to perform evaluations of our strengths and vulnerabilities. In addition, we perform an annual enterprise risk assessment procedure that evaluates business continuity risks, including an evaluation of cybersecurity risks. The results of these evaluations, along with recommendations for improvements and remediations to our cybersecurity program, if deemed necessary, are periodically reported to senior management and the audit committee of our board of directors, which is tasked with oversight of our cybersecurity program. Reports provided to our senior management and audit committee include updates on our cyber risks and threats, the status of projects to strengthen our information technology systems and assessments of our cybersecurity program. Our senior management and audit committee use the results from these evaluations and reports as part of their risk assessment and decision-making functions.

companyName: Kiniksa Pharmaceuticals International, plc

ticker: KNSA


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program incorporates external guidance and expertise through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber-insurance, advisory services, and legal counsel.

companyName: GENTEX CORP

ticker: GNTX


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with our information security programs and practices. Internal and external auditors assess our information technology general controls on an annual basis.

companyName: Knife River Corp

ticker: KNF


text: Disclosure Committee The Disclosure Committee, which consists of individuals from our legal, accounting, finance and investor relations groups, provides general oversight in the area of cybersecurity and privacy reporting, and is responsible for making disclosure determinations regarding cybersecurity incidents. The Disclosure Committee also receives periodic updates from the Chief Information Security Officer regarding threat detection and incident response.

companyName: US Foods Holding Corp.

ticker: USFD


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity processes through trainings.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Information Security team monitors events, analyzes threats and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets, assessing and prioritizing risks and employing various tools and techniques to identify and remediate threats. We also leverage third party service providers to test and validate our existing processes and procedures. We conduct annual and ongoing security awareness and behavioral change training for employees to educate them on cybersecurity best practices and train them to recognize phishing attempts. We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or vendors who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to board committees.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: In collaboration with the IT Department, OFS Advisor's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. The IT Department's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. The IT Department's controls leverage the National Institute of Standards and Technology Cyber Security Framework. The IT Department also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources, including resources allocated to OFS Advisor.

companyName: OFS Capital Corp

ticker: OFS


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C. "Cybersecurity" in their 2024 Form 10-K filed on February 20, 2025.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Our Cybersecurity Risk Mitigation Practices are managed on a day-to-day basis by members of our Information Security Steering Committee, or the Committee, and are overseen by our Board of Directors. The Committee is composed of senior management, including our Chief Information Officer and Chief Financial Officer, and senior vice presidents from various areas of the organization including IT, compliance, legal, operations and human resources, including the Vice President of Information Security and Compliance. The Vice President of Information Security and Compliance has over 40 years of IT experience and is a certified information systems security professional. The Chief Information Officer has over 10 years of experience managing cybersecurity, data protection, and incident management teams, and over 20 years of experience managing compliance and regulatory processes and controls.

companyName: PC CONNECTION INC

ticker: CNXN


text: The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats. This program scores, ranks, and reports risks to Company management based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Technology Finance Corp.

ticker: OTF


text: Employee Training and Awareness Programs: We provide training to our management and employees designed to equip employees with the knowledge and skills necessary to identify and respond to cybersecurity risks, tailored based on the persons' roles within our organization.

companyName: Jet.AI Inc.

ticker: JTAI


text: The Chief Information Security Officer's organization includes managers who have led cybersecurity programs in other industries such as robotics and AI, consulting, telecommunications, healthcare and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Technology Officer (CTO), Chief Legal Officer (CLO), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: In alignment with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and FHFA regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including SaaS and IaaS engagements. We endeavor to continuously develop our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include, but are not limited to the following: performing regular risk assessments to identify, understand, and prioritize risks from cybersecurity threats; the implementation of firewalls, anti-virus software, and real-time network monitoring; the deployment of software updates to address security vulnerabilities; maintaining a vulnerability management program to timely identify and remediate cybersecurity risks, and; periodic employee training to educate employees on how to identify and avoid various forms of social engineering.

companyName: Federal Home Loan Bank of Boston


text: Our advisor utilizes a team of dedicated external IT professionals, which leads enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The IT professionals provide periodic reports to our board of directors, our advisor and its affiliates, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by our advisor and external experts with the results of those reviews reported to senior management and the board of directors. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced potential threats to and incidents related to our data and systems, including malware and phishing attempts. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other technology assets (and the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third parties, or an inability to effectively upgrade such systems and assets, including operating system integration of acquired companies, could cause a significant disruption to our business and have a materially adverse effect on our results of operations" in Item 1A- Risk Factors.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: Our operations rely on third-party service providers and software programs. For instance, our accounting and financial reporting-related systems use software obtained from third-party service providers, and these systems are necessary for the efficient and consistent operation of our business. We use these systems to communicate with tenants, banks, vendors, and others, and to manage our accounting, financial reporting, and for other recordkeeping purposes. We, thus, maintain a process to identify and evaluate cybersecurity risks and incidents associated with key third-party providers. When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.

companyName: MAYS J W INC

ticker: MAYS


text: Our Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Chief Security Officer earlier this year after previously serving in that role at ironSource, prior to its merger with us.

companyName: Unity Software Inc.

ticker: U


text: Managing cybersecurity risks and securing our sensitive data and systems are a critical part of our business operations and of paramount importance to our organization. The Company has implemented and maintains multiple layers of physical, administrative, and technical security processes designed to protect our facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems and data residing on those systems, including employee data, customer data, and proprietary information.

companyName: VOXX International Corp


text: The Company has established an Information and Cybersecurity program. The program is directed by the Company's Information Security Strategy Board ("ISSB"). The purpose of the ISSB is to (i) provide management direction and support for information security risk oversight for the Company's information security program and (ii) to engage Company leaders to promote information security risk awareness and sound information security risk management practices across the organization. The ISSB has been delegated authority from the Company's Enterprise Risk Management Committee ("ERM Committee") to advance and monitor the overall effectiveness of the Company's information security program and risk management activities. The ISSB also has the authority to direct effective and timely implementation of actions to address emerging information security risks and information security risk management deficiencies. The ISSB meets at least quarterly.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Notwithstanding our cybersecurity risk management and governance, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption "Significant disruptions of our information technology systems or data security incidents could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability."

companyName: ROKU, INC

ticker: ROKU


text: SandRidge has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with IT professionals to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. The underlying controls of our cybersecurity risk management are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: We periodically assess risks from cybersecurity threats, and monitor our information systems for potential vulnerabilities. However, to date, given the small size of our company and the nature of our operations, our reliance on information systems has been limited to the use of standard off-the-shelf software (such as Google, QuickBooks and Microsoft Office) and the use by our employees of standard personal computers. Accordingly, management has not implemented any formal process for assessing, identifying, and managing risks from cybersecurity threats.

companyName: Tradewinds Universal

ticker: TRWD


text: Our cybersecurity partners, including consultants, and other third-party service providers are a key part of our cybersecurity risk management strategy and infrastructure. These partners provide services including, but not limited to configuration management, penetration testing, network protection and monitoring, remote monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.

companyName: Banzai International, Inc.

ticker: BNZI


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Audit Committee and the Aerospace Safety Committee, and each committee reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our Chief Information Digital Officer and Senior Vice President, Information Technology & Data Analytics (CIDO) and our Chief Security Officer (CSO) provide presentations to the Audit Committee on cybersecurity risks at each of its bimonthly meetings. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. In addition, the Audit Committee has designated one of its members with expertise in cyber risk management to meet regularly with management and review our cybersecurity strategy and key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. The Aerospace Safety Committee provides oversight of the risks from cybersecurity threats related to our aerospace products and services. The Aerospace Safety Committee receives regular updates and reports from senior management, including the Chief Engineer, the Chief Aerospace Safety Officer, and the Chief Product Security Engineer, who provide briefings on significant cybersecurity threats or incidents that may pose a risk to the safe operation of our aerospace products. Both committees brief the full Board on cybersecurity matters discussed during committee meetings, and the CIDO provides annual briefings to the Board on information technology and data analytics related matters, including cybersecurity.

companyName: BOEING CO

ticker: BA


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, and ensures that the Company is prepared to detect, analyze, contain, eradicate, and recover from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.

companyName: NELNET INC

ticker: NNI


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. While the board of directors' audit committee is responsible for overseeing management's risk assessment and risk management policies generally, to enhance oversight and governance in this area, the board of directors has recently established a standing committee (the "Cybersecurity Committee"), that will advise on cybersecurity matters and provide strategic guidance and direction for our cybersecurity program. The Cybersecurity Committee will convene as necessary to address critical or emerging cybersecurity concerns and to ensure alignment on approach. In the event of an incident, the Company has developed an incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Our CCO provides briefings to the audit committee throughout the year regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our CCO provides annual briefings to the board of directors on cybersecurity risks and activities. Our board may also be notified and engaged as part of the Company's cybersecurity incident response plans, depending on the significance of an incident.

companyName: HARMONIC INC.

ticker: HLIT


text: Our cybersecurity incident response policy and plan are designed to escalate certain cybersecurity incidents to a Security Incident Response Team ("SIRT"), comprised of the CIO, CISO, GC, CCO and Senior Director of Engineering. The SIRT works with NetScout's incident response team to help NetScout mitigate and remediate cybersecurity incidents of which they are notified. In addition, NetScout's incident response plan includes reporting to the CEO and Chair of the Audit Committee of the Board of Directors for certain cybersecurity incidents. NetScout's Cybersecurity Disclosure Committee, which includes the SIRT and the Chief Financial Officer, assess the materiality of cybersecurity incidents for potential disclosure requirements according to an escalation process defined in NetScout's Cybersecurity Protocol for Disclosure Controls and Procedures.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our Chief Information Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Information Officer has nearly four decades of overall information technology experience in secure environments, including nine years of infrastructure and cybersecurity leadership at our Company. Furthermore, our Strategy Committee Chair brings nearly four decades of technical and organizational leadership experience, having previously held senior US government positions as the Principal Deputy Director of National Intelligence and the Senior Advisor to the Director for Cyber and Director of Information Operations for the CIA, where she was responsible for cyber operations, foreign cyber threat assessment, and cybersecurity. She sits on the boards of several public and private technology companies, filling the role of their cybersecurity expert.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: The Company's Board of Director oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.

companyName: MIAMI BREEZE CAR CARE INC

ticker: MIBE


text: The Company's cybersecurity team is headed by its Executive Director Global Lead of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's Interim CEO, President, and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: Cibus, Inc.

ticker: CBUS


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information. The CRO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs. Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A. "Risk Factors. "

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We also conduct IT security assessments on our key third-party service providers and require them to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our company.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: The Bank has implemented an information security program that encompasses the Bank's cybersecurity efforts as part of its risk management process. Risk assessments, including Information Technology and Cybersecurity Risk, are conducted annually by the Chief Risk Officer, Information Technology Officer and Information Security Officer to identify, assess and mitigate risks.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: • conduct annual customer data handling and use requirements training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for employees with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • utilize an incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • maintain multiple layers of controls, including embedding security into our technology investments; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • external reviews of our cybersecurity position to help ensure adherence to best practices and validate risk assessments and response plans.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: We maintain policies and controls designed to identify, assess, manage, mitigate, protect against, and respond to cybersecurity threats. Our cybersecurity risk management strategy is established by management and is implemented by our IT professionals and the business units in which potential threats may occur. The Audit Committee of our Board of Directors (the "Audit Committee") has primary responsibility for overseeing management's strategy related to mitigating risk associated with cybersecurity threats. We maintain: (i) business continuity and disaster recovery plans that are expected to be deployed in response to a significant cyberattack; (ii) cyber incident response plans; and (iii) cybersecurity insurance that, subject to policy coverage and limitations, protects against financial harm to the Company caused by material cybersecurity events. While we believe our cybersecurity risk management strategy is appropriate for our current business, no strategy can fully protect against all possible adverse events. See "Item 1A. Risk Factors—Industry and Market Risks—Our business could be adversely affected by events outside of our control, including armed conflicts, war, terrorist attacks or threats, pandemics, natural disasters, cyber-based attacks, or other significant events."

companyName: Talen Energy Corp

ticker: TLN


text: We currently engage a qualified IT consultant who reports to our Chief Executive Officer. This consultant has robust experience with cybersecurity, information technology development and deployment and information technology risk assessment and management, including information security management.

companyName: Decoy Therapeutics Inc.

ticker: DCOY


text: Our Information Security Officer has more than 40 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security, information technology, and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from Missouri State University with focus on Business Administration Systems coursework.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We are committed to securing and strengthening our information systems against cybersecurity threats and protecting the privacy and security of our customer, employee, and company data. However, as outlined in "Item 1A. Risk Factors — Risks Related to IT Systems, Cybersecurity and Data Privacy" of this Annual Report on Form 10-K, we are acutely aware that cybersecurity threats are a persistent concern in today's digital world. Despite our investments in securing our information systems, we understand that cybersecurity incidents can still occur, potentially causing material harm to our brand, business, operations, and financial condition. In light of this, we have developed a cybersecurity risk management program to identify, assess, monitor and manage cybersecurity risk.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our operations are dependent on our information technology systems, and the systems of our third party partners, upon which we rely, to maintain our ability to access, store, and transmit sensitive information in a secure manner. One of the primary risks to which we are exposed is the risk that our information systems are compromised, either deliberately or unintentionally, and that sensitive information is disclosed, misused or corrupted, or our operations are disrupted. Such an incident could result in a number of adverse consequences, including disruptions in customer relationship management, system damage, remediation costs, litigation, and reputational damage. We maintain an information security and governance program that is designed to protect our information systems against such risks.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Cyber partners are also a key part of our cybersecurity infrastructure. We utilize third -party software to provide continuous monitoring of our infrastructure and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is intended to prepare support teams in the event of a significant incident.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: Our management team, including our Chief Financial Officer, along with third party infrastructure providers are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program. Our Chief Financial Officer has experience supervising and managing company information technology departments.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management and/or the Board of Directors depending on the circumstances. The Board receives periodic reports and updates from our senior management concerning significant cybersecurity threats and risks, and the processes that the Company has implemented to address them, when deemed appropriate.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for seven years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows: • The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents. • The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team. • The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation. • The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: We use specialized IT tools and services, including with the support of third-party service providers, to understand, manage, mitigate and continually remediate identified risks. The Company logs identified cybersecurity risks and tracks corresponding risk management activities. Identified cybersecurity risks are discussed with management for resolution planning and escalation.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: The Company's Enterprise Risk Management Policy assists the Board of Directors and management in clarifying their tolerance for identifying those credit, market, liquidity, operational, legal, compliance, strategic, reputation and security (information and physical) risks that have the potential to cause material financial harm to the institution, as well as describing a methodology for determining the proper level of controls to manage and mitigate those risks. Cybersecurity is a critical component of risk management, given the increasing reliance on technology and the increasing cybersecurity threat landscape. The Information Security Program is built on the Federal Financial Institutions Examination Council (FFIEC) IT Handbooks, National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Cybersecurity Controls (CSC), and industry best practice. The Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect Company assets and information.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Board has ultimate oversight of cybersecurity risk. The Board reviews management's assessment of our key enterprise risks and its strategy with respect to each risk, including cybersecurity risks, and receives a corresponding risk management update annually. The Information Technology Committee of the Board reviews the effectiveness of our cybersecurity controls and procedures, including procedures to identify and assess internal and external risks from cybersecurity threats; controls to prevent and protect from cyberattacks, unauthorized access or other malicious acts and risks; procedures to detect, respond to, mitigate negative effects from and remediate cybersecurity attacks; and controls and procedures for fulfilling applicable regulatory reporting and disclosure obligations of the risks and costs of cybersecurity incidents. Our Chief Information Security Officer ("CISO") briefs or provides a report to the Information Technology Committee on our cybersecurity and information security posture and program at least quarterly, including penetration test results and related remediation and significant cybersecurity incidents. The CISO also provides an annual cybersecurity update to the full Board.

companyName: ASSURANT, INC.

ticker: AIZ


text: Management plays an integral role in assessing and managing the Company's material risk from cybersecurity risks. The assessment and management of those risks is led by the Company's CISO, who has over 20 years of experience working in information technology, including over 10 years specifically focused on information security, infrastructure, and strategy, and the Company's CIO, who has over 30 years of experience in Retail, Consumer Products, Merchandising, and IT, of which 16 years have been in leadership roles, and implemented by the CISO's team, who are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, processes and operations. The CISO and CIO lead quarterly meetings of the Company's Security Executive Steering Committee (the "Steering Committee"), which is composed of the Company's CFO, General Counsel, and CIO. The Steering Committee drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.

companyName: CARTERS INC

ticker: CRI


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and the General Counsel of Douglas Elliman Realty LLC and, if appropriate, the CFO of Douglas Elliman Realty LLC, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: The Company's enterprise risk management committee (the "ERM Committee") is tasked with, among other responsibilities, identifying and evaluating operational risks, which includes risks associated with information technology and cybersecurity. The ERM Committee includes senior leaders across business functions, including the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer (CFO), Chief Legal Officer, Chief Risk Officer (CRO) and CAO. The ERM Committee, as part of its comprehensive risk management duties, discusses Company strategies to prevent cyber-attacks and the Company's response and remediation of threats. The CAO provides a quarterly report to the Risk Management Committee that summarizes cybersecurity risks, relevant events and other items of note identified by management or the ERM Committee. The ERM Committee meets independently of the Risk Management Committee, with a representative from the Risk Management Committee in attendance. Certain members of the ERM Committee are invited to attend and participate in meetings of the Risk Management Committee.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: In connection with the Acquisition, we recently reshaped our Board of Directors, which is addressing the implementation of a number of internal policies and procedures, among them cybersecurity and risk assessment. While we presently do not have formal cybersecurity and risk assessment policies and procedures in place, which may make us susceptible to heightened cybersecurity risks, we do not at this time anticipate collecting or storing any significant personal information, personal data or confidential information related to customers, consumers, employees, or vendors. Moreover, we have invested in measures to reduce these risks and we intend to have our Board of Directors develop, adopt and implement a cybersecurity risk management program and formal processes for assessing risk, which may be implemented by Company personnel or which we may outsource to be managed by third party service providers. In addition, pursuant to applicable SEC transition guidance, certain disclosures required in this item will only be applicable to the Company from the fiscal year ending on December 31, 2024. See "Risk Factors" for additional information.

companyName: Charging Robotics Inc.

ticker: CHEV


text: Our CISO is the member of our management who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across BlackLine. She has over 15 years of experience as a chief information security officer responsible for enterprise-wide oversight of information security programs. She holds CISSP and CISM certifications, and a BS in Computer Science. She leads a team of information security professionals, and works in coordination with the Chief Information Officer, the Chief Legal and Administrative Officer, the Senior Vice President, Cloud Engineering and Operations, and other members of management.

companyName: BLACKLINE, INC.

ticker: BL


text: As part of its oversight responsibilities over risks and controls, the Board is ultimately responsible for overseeing our cyber and information security risks. The Audit Committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Members of the ORC and other Monroe Capital personnel periodically report to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Monroe Capital's cybersecurity program as it impacts us, the external threat environment, and Monroe Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Monroe Capital's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: LENSAR, Inc.

ticker: LNSR


text: The Audit Committee ultimately provides information to our board members regarding its activities, including those related to cybersecurity risks. The Audit Committee also receives a briefing and continuing education from a member of the third party vendor relating to our cyber risk management program at least annually. The third party vendor is responsible for notifying the Audit Committee of material cybersecurity incidents.

companyName: American Bitcoin Corp.

ticker: ABTC


text: 2.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. Historically, the Company's subsidiary NTS and its team of professionals, including NTS' Chief Information Security Officer ("CISO"), who currently serves as our CISO, and CTO, and their team of professionals, have managed the Company's IT infrastructure, including our dedicated server hosting, managed cybersecurity, backup and disaster recovery, and other related services. As of the January 2, 2025, close of our divestiture of NTS to IPM, we and IPM entered into a Master Services Agreement pursuant to which IPM provides us with the same services NTS provided to the Company prior to the divestiture. Our CTO is responsible for overseeing IPM's provision of the managed technology services, including cybersecurity, to NewtekOne. In addition, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity. These external stakeholders conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Our audit committee receives quarterly presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by other public companies.

companyName: Scilex Holding Co

ticker: SCLX


text: Cybersecurity risks are considered within our broader enterprise risk management ("ERM") framework as part of our overall risk assessment process. We maintain a comprehensive Information Security Program and controls that are designed to assess, identify, manage, contain, and recover from material cybersecurity risks. The Information Security Program is also designed to identify emerging cybersecurity and information security risks and apply safeguards to the Company, our assets, customer, and employee data. The Information Security Program also addresses cybersecurity risks associated with our use of third-party service providers through systems and processes that are designed to assess, identify, and reduce the potential likelihood and impact of a cybersecurity incident at our third-party service providers. However, we rely on our third-party partners to implement effective information security programs commensurate with the risk associated with the nature of their business relationships to us and cannot ensure in all circumstances their efforts will be successful. The Information Security Program is based on Center for Internet Security ("CIS") Controls, a cybersecurity framework that is acknowledged worldwide and is designed to comply with applicable laws and guidelines.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: For a discussion of information technology rights that may materially impact us, see Item 1A "Risk Factors—We rely on information technology to support our operations and reporting environments. A security failure of that technology, including with respect to cybersecurity, could impact our ability to operate our businesses effectively, adversely affect our financial results, damage our reputation and expose us to potential liability or litigation."

companyName: BRUKER CORP

ticker: BRKR


text: Lessons learned—no later than two weeks from the end of the incident, perform a retrospective of the incident. Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it and whether anything in the incident response process could be improved.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the cybersecurity infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate.

companyName: VISA INC.

ticker: V


text: The Company's Security Awareness Program provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The Program also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. The Program also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.

companyName: LAKE SHORE BANCORP, INC.


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Strategic Operations Officer, Chief Digital Officer and Chief Brand and Innovation Officer.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program as part of our ISO 27001 2022 certification designed to protect our systems and the confidentiality, integrity and availability of our data.

companyName: Renalytix plc

ticker: RNLXY


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 25 years of technology leadership experience, including 19 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: Cybersecurity incidents may be detected through a variety of means, including employee notification to our IT personnel, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan. Events that could have a high impact or that require additional judgment are escalated to the Information Security Council ("ISC"). The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: We have experienced targeted and non-targeted cybersecurity incidents in the past, including an incident in August 2023 that affected certain of our information systems and resulted in temporary disruptions to parts of our operations. However, prior cybersecurity incidents, including the August 2023 incident, have not materially affected us. Notwithstanding our cyber risk management program, we may not be successful in preventing or mitigating a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition. Refer to Item 1A. "Risk Factors" for further information on the risks we face from cybersecurity threats.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Item 1A - Risk Factors - of this 10-K.

companyName: CITIZENS, INC.

ticker: CIA


text: Our Information Security Policy and procedures are reviewed on an ongoing basis. These procedures are implemented by our Chief Information Security Officer, assisted by Managed Service Provider ("MSP"). Our MSP has over 15 years of experience and possesses various cybersecurity certifications. Third-party service providers can assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Our processes for assessing, identifying, and managing cybersecurity threats have been integrated into our overall risk management processes. Our cybersecurity and risk management program is structured around strategy, execution, management, oversight, and user training, with ongoing evaluations to ensure its effectiveness.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Our Board of Directors (the "Board") recognizes the importance of cybersecurity in today's digital landscape. We are committed to safeguarding our information systems and data assets. This enables us to maintain the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in overseeing our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity processes are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect and store, including information regarding our customers, suppliers and employees. As part of our risk management program, we actively work to identify, prevent and mitigate cybersecurity threats, and take steps to be prepared to effectively respond to cybersecurity incidents when they occur.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. We are committed to implementing leading data protection standards, and have a comprehensive set of written policies and standards that follow the guidance of the industry standard cybersecurity frameworks.

companyName: American Homes 4 Rent

ticker: AMH


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Trust did not identify any risks from cybersecurity threats, including previous cybersecurity incidents, that the Trust believes materially affected, or are reasonably likely to materially affect, the Trust, including its business strategy, operational results, and financial condition.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: We believe that currently we have not encountered a cybersecurity event that has had a material impact on our business. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.

companyName: VALUE LINE INC

ticker: VALU


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 30 years of experience in cybersecurity, serving as a Security Officer while in the United States Navy and CISO at Amgen and Warner Bros and in various other Cybersecurity roles at KPMG and Forrester.

companyName: GoPro, Inc.

ticker: GPRO


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Vice President - Technology assigned as the executive risk owner. Our Senior Vice President - Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President - Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board and Audit Committee, when appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: We manage cybersecurity risk through three core teams: cybersecurity engineering, data privacy, and a security operation center. These teams are responsible for overseeing data safety during new system and infrastructure deployments, maintaining appropriate cybersecurity controls, and monitoring, documenting and investigating any anomalies affecting employees, suppliers, and customers. Our IT security controls are designed to align with the NIST (National Institute of Standards and Technology) standards and are tested on an ongoing basis. These controls and procedures include processes that oversee and identify cybersecurity risks associated with third-party service providers that we engage, as described below. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets. To support our internal risk management structure, we use third-party specialists to monitor for emerging threats, conduct vulnerability scans and analysis including simulated hacker attacks, and audit our cybersecurity framework. We also maintain an information security risk insurance policy in the event of a security breach. Our internal audit function also performs independent testing on aspects of the operations of our cybersecurity program and the supporting controls based upon its risk-based internal audit plan and reports the results of these audits in its periodic reports to the Audit Committee.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Recognizing that no single technology, process or business control can effectively prevent or mitigate all risks, we employ multiple technologies, processes and controls, all working as part of a cohesive strategy to minimize risk including the following: • We emphasize security and resiliency through business assurance capabilities and incident response plans designed to identify, evaluate, and remediate incidents when they occur. We regularly review and update our plans, policies and technologies and conduct regular training exercises and crisis management preparedness activities to test their effectiveness. • Perrigo leverages the NIST cybersecurity framework to measure the capability of its cybersecurity program and we conduct third party assessments to measure the NIST ratings. • We maintain a cybersecurity risk register which is reviewed periodically with relevant stakeholders. Risks that are higher in impact are included within our Enterprise Risk Register which is reviewed with Executive Leadership and the Board of Directors. • Our processes used to identify, assess, protect, detect, respond to and recover from cybersecurity threats is regularly tested by external parties through penetration testing, and other exercises designed to assess and test our cybersecurity health, resiliency and the effectiveness of our program. • Management invests in organization capability and technology to manage and identify cybersecurity and information security risks. Our Company has information security employees across the globe, enabling us to monitor and promptly respond to threats and incidents, identify and maintain oversight of cybersecurity risks associated with third parties, evaluate and deploy cybersecurity technologies, and educate associates on cybersecurity risks. • We maintain cyber insurance coverage to help mitigate possible costs associated with a potential incident. • We have implemented an information and cybersecurity awareness program designed to educate and test employee maturity at least annually, and regularly throughout the year employees receive training regarding phishing and other threat actor schemes, the inherent risks involved in human interaction with information and operational technology, and new and emerging technologies.

companyName: PERRIGO Co plc

ticker: PRGO


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cyber security incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: We have a standing risk committee. The purpose of the risk committee is to oversee a sustainable dynamic process that enables enterprise-wide cross-functional analysis and assessment of risks that may threaten the Company or provide opportunities to leverage resources to create growth opportunities. Under its charter, the risk committee is to be comprised of at least three members of the Board, selected by the President. The committee has established a working group that is comprised of representatives from the following functional areas of the Company: treasury, human resources, legal, supply chain management, sales, and marketing. Currently, the Senior Vice President, Secretary and General Counsel, a member of the risk committee, apprises the Board quarterly of the working group and this Committee's activities.

companyName: GRAYBAR ELECTRIC CO INC


text: We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above. Audit results and the risk assessments are reviewed by our Chief Financial and Administrative Officer, the principal of the MSSP, and our Vice President of Risk Management. Any exceptions are addressed with a remediation plan and implemented with appropriate resources. Audit results, risk assessments and remediation plans are discussed with the Audit Committee of the board of directors, who has responsibility for cybersecurity risk oversight, each quarter until all points are fully resolved.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: We provide disclosures on the potential material impacts of cybersecurity threats on our business operations, which are detailed under the heading 'Risks Related to Our Business Operations' in Item 1A of this Annual Report on Form 10-K, and those disclosures are incorporated by reference herein.

companyName: Sunrun Inc.

ticker: RUN


text: Many of our facilities serve several of our businesses and may be used for multiple purposes, such as for administration, sales, research, laboratory matters, manufacturing, and service operations. We consider our facilities suitable and adequate for their respective purposes and do not anticipate difficulty in renewing existing leases as they expire or finding alternative facilities if necessary.

companyName: GE Vernova Inc.

ticker: GEV


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer, as well as our Associate Vice President of IT. The Board of Directors also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: Our Board of Directors has an active role in oversight of our risks and is assisted by management in the exercise of these responsibilities. Our Manager of Information Technology prepares and gives a presentation to the Board at each of its quarterly meetings, which includes updates on cybersecurity. Our IT Manager is responsible for assessing and managing risks from cybersecurity threats and carrying out our formal cybersecurity event plan. Our IT Manager is responsible for reporting material incidents to our Chief Executive Officer, who in turn will report to the Lead Independent Director. Our IT Manager has over 20 years of information technology experience in the energy industry.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: We experienced a cyberattack in January 2023. We believe the incident has not had nor will have a material impact on our business, operations, ability to serve our customers, or financial results. At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts. See "Risk Factors - Cyberattacks, like our 2023 cybersecurity incident that was previously disclosed, can lead to disruption of business, reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position."

companyName: QUICKLOGIC Corp

ticker: QUIK


text: We promote a company-wide culture of cybersecurity risk management to ensure that cybersecurity risk considerations are an integral part of decision-making at all organizational levels. To protect the confidentiality, integrity and availability of our data and information systems, we have implemented cyber defenses and continuously enhance them to address evolving threats. Our information technology (IT) department actively monitors and evaluates our cybersecurity practices to ensure alignment with our business objectives and operational needs. Our cybersecurity program is comprehensive in scope and covers the systems supporting all our business operations.

companyName: Green Plains Inc.

ticker: GPRE


text: Management's Role Managing Risk Company management is directly involved in assessing and managing risks from cybersecurity threats. The Company employs a CISO with substantial program management experience, along with a team of cybersecurity and IT professionals. The CISO reports directly to the Senior Vice President and Chief Product and Technology Officer, who is a member of the Company's Executive Leadership Team. Additionally, the CISO reports regularly on the cybersecurity program, including risks and mitigation, to the Cybersecurity Executive Steering Body. The Cybersecurity Executive Steering Body provides strategic oversight and is responsible for guiding and aligning organizational efforts to manage risks associated with cybersecurity threats. It is intended to ensure comprehensive risk management, effective policy development, and coordinated response measures to safeguard sensitive information and technology assets.

companyName: MSA Safety Inc

ticker: MSA


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team and Information Security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We utilize the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines 108 subcategories of security controls and outcomes over five functions: identify, protect, detect, respond and recover.

companyName: Century Communities, Inc.

ticker: CCS


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain an incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat; containing the threat; remediating the threat, including recovery of data and access to systems; analyzing any reporting obligations associated with the incident and performing post-incident analysis. We have relationships with a number of third-party service providers to assist with cybersecurity monitoring, containment and remediation efforts.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches or cybersecurity incidents could adversely affect our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation.," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. We are also structured to CMMC which aligns with DOD/Federal contractor program compliance. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: PARSONS CORP

ticker: PSN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan, incident detection and response, disaster recovery and business continuity plans, risk assessments, network security controls, access controls, user management, asset management, hardware and data segregation, system monitoring and regular reviews.

companyName: Personalis, Inc.

ticker: PSNL


text: We have developed and implemented, and continue to implement, cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. Primary cybersecurity oversight responsibility is shared by our board of directors, our audit and compliance committee ("Audit Committee"), and senior management.

companyName: Zeo Energy Corp.

ticker: ZEO


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: ZeroStack Corp.

ticker: ZSTK


text: Our Board, with direct oversight by the Audit Committee and senior management, ultimately presides over our management of cybersecurity risk. The Board routinely receives reports from the Cybersecurity Committee, via the Audit Committee, about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information system security vulnerabilities.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outline internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our strategy for managing cybersecurity risk is integrated into the Company's overall risk management program and structure, as depicted in the Corporate Governance section of our Proxy under "Risk Oversight."

companyName: REGENCY CENTERS LP


text: Sponsor has adopted an organizational wide cybersecurity program. The program is administered by the Head of IT of the Sponsor (the "Head of IT"). The Sponsor's objective, in the development and implementation of this comprehensive cybersecurity program, is to create effective administrative, technical, and physical safeguards for the protection of personal information of the organization and its clients.

companyName: CoinShares Bitcoin ETF

ticker: BRRR