text: Key components of the Company's cybersecurity program: • Risk Management: The Company continuously assesses and mitigates cybersecurity risks across the organization by leveraging industry best practices and frameworks such as NIST Cybersecurity Framework. • Governance and Oversight: The Company's Board of Directors (the Board) regularly reviews cybersecurity matters, ensuring alignment with business objectives and regulatory requirements. A designated Information Technology Strategic Committee, which includes many subject matter experts from the Board and Executive Management, meets quarterly to provide additional focus and expertise in this area. • Security Controls: The Company has implemented robust technical and procedural controls to protect information assets, including firewalls, intrusion detection systems, encryption, access controls, and multifactor authentication. These controls are tested periodically by external technology audit firms with penetration tests and security audits. • Policy Controls: Annually all employees sign off on the Company's data and device controls. The Company ensures that all information access points are the Company's assets and all data passing through these access points are accessible by the Company and can be deleted whenever the Company deems necessary. • Employee Training and Awareness: Ongoing cybersecurity training and awareness programs are implemented to educate employees about potential threats, phishing attacks, social engineering tactics, and best practices for safeguarding company information. • Incident Response: The Company maintains a comprehensive incident response plan to promptly detect, contain, and recover from cybersecurity incidents. Regular testing and simulation exercises ensure readiness and effectiveness of response capabilities. • Third-Party Risk Management: The Company regularly evaluates and monitors the cybersecurity posture of third-party vendors and partners with whom data is shared or relied upon for critical services, to ensure they meet the Company's security standards. • Continuous Improvement: The Company regularly reviews and makes enhancements to the cybersecurity program to adapt to emerging threats, technological advancements, and changes in regulatory requirements. Implementation of new technologies, practices, and infrastructures to target security vulnerabilities is ongoing. • Compliance and Reporting: The Company adheres to relevant cybersecurity regulations and standards applicable to the Company's industry and maintains transparency by disclosing material cybersecurity incidents or risks in accordance with regulatory obligations. The Company had no material cybersecurity incidents in 2024.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (such as the Cybersecurity Framework established by the National Institute of Standards and Technology at the U.S. Department of Commerce), proficiency in security tools such as security information and event management systems, intrusion detection systems and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices, as well as analyzing logs, investigating security incidents, and performing forensic analysis.

companyName: Arcellx, Inc.

ticker: ACLX

secItem: Item 1C


text: We have an enterprise-wide information security platform, which is part of our enterprise risk assessment process and designed to protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework. To protect our information systems from cybersecurity threats, we seek to use best-in-class security tools that help prevent, identify, escalate, investigate, resolve and recover from identified security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools. We also maintain a third party security operations service to identify, prioritize, assess, mitigate and remediate risks. We rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: To further maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. In addition, our Chief Executive Officer receives regular updates from the Chief Information Security Officer, reviews reports of key developments involving our Information Security Program and meets with our Information Security team at least quarterly to review the readiness and effectiveness of our program. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees.

companyName: RADIAN GROUP INC

ticker: RDN


text: Our management, including our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), and Information Technology team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to provide reasonable assurance that such potential cybersecurity risk exposures are monitored, instituting appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Additionally, since we do not have a full time Chief Information Security Officer, we obtain additional domain expertise from third party outside resources. Our cybersecurity programs are managed under the direction of our CFO, who receives reports from our Information Technology team and third-party resources to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks.

companyName: AstroNova, Inc.

ticker: ALOT


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team, or specific protocols to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan, or engaged with external cybersecurity consultants for assessments or services.

companyName: Toughbuilt Industries, Inc


text: In addition, the CISO periodically briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.

companyName: CONTINENTAL RESOURCES, INC


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association, and the Texas Bankers Association. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget, and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Our cybersecurity risk management ("CSRM") program, which is designed to protect the confidentiality, integrity and availability of our critical systems and information, includes a comprehensive cybersecurity incident response plan.

companyName: Avery Dennison Corp

ticker: AVY


text: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for unauthorized access to our information technology systems and identify potential security threats through various automated detection solutions. To protect the security of our information infrastructure and protect our systems and information from unauthorized access, we draw on the knowledge and insights of an external information technology consultant who acts as our primary IT administrator and employ an array of third-party tools and technologies. As part of its oversight, the Audit Committee also oversees and identifies risks from cybersecurity threats associated with our use of an external information technology consultant, as well cybersecurity threats posed by our engagement of other similar third-party providers.

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: Our cybersecurity program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, Conference of State Bank Supervisors Ransomware Self-Assessment Tool, the Gramm-Leach-Bliley Act and the Sarbanes-Oxley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Federal Reserve and the Arkansas State Bank Department to review our cybersecurity program and discuss the changing threat landscape.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: Management, including the IRAC, is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: In an effort to mitigate the impact of cybersecurity events, we conduct mandatory information technology and cybersecurity training for all employees upon hire and at least annually thereafter, and regularly test our employees for information security awareness and adherence to our information technology and cybersecurity policies, which are reviewed at least annually. We also provide our employees with access to educational newsletters and articles regarding relevant information technology and cybersecurity matters on a regular basis. Additionally, we utilize third-party experts to review and test our information technology infrastructure, including constant monitoring for suspicious activity, routine penetration testing of our networks, and an annual security assessment of the effectiveness of our informational technology environment to identify potential vulnerabilities. For example, our VP, Information Systems & Solutions and Director, Information Technology receive monthly reporting from our managed security service provider and meet regularly to discuss reported activity. Our VP, Information Systems & Solutions and Director, Information Technology also meet with the cybersecurity solutions team at our managed security service provider on a quarterly basis to review and discuss the Company's cybersecurity vulnerability score and key risk indicators, including security alerts, specific vulnerabilities, and remediation cadence, as well as peer comparisons and enhancements to the Company's cybersecurity program. Our third-party service providers of technology services are generally required to provide us with system and organization controls (SOC) reports prior to formal engagement and annually thereafter. The reports are reviewed by our VP, Internal Audit and our VP, Information Systems & Solutions, or their designee(s), to assess and monitor compliance with cybersecurity best practices.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: Mr. Lee provides periodic updates on any cybersecurity incidents and threats to our Board of Directors and to the Audit Committee of our board of directors as such incidents may arise.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: Our business is subject to various cybersecurity risks, including but not limited to, unauthorized access to sensitive data, including customer information and medical information, disruption of operations or supply chain due to cyberattacks, theft or manipulation of intellectual property, such as proprietary strains or cultivation techniques, regulatory non-compliance resulting from cybersecurity breaches, including violations of data privacy laws. To address these risks, we have implemented a comprehensive cybersecurity program, which includes, regular risk assessments and vulnerability testing to identify and remediate potential weaknesses in our infrastructure, deployment of advanced access controls, encryption, and endpoint protection to safeguard sensitive data such as customer and medical information, mandatory annual cybersecurity training and awareness programs for all employees to reduce the risk of social engineering and phishing attacks, and continual monitoring and incident response protocols to detect, contain and respond to cybersecurity incidents in a timely and effective manner. We also have information security and data privacy policies and procedures in place applicable to our directors, officers, employees, contractors and suppliers. Third parties service providers also contribute to our overall cybersecurity. We engage third parties that are cybersecurity experts to support in the design, implementation and continuous improvement of our cybersecurity program.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: In the event of a cybersecurity incident, the CEO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Clubhouse Media Group, Inc.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: NETLIST INC

ticker: NLST


text: The board of directors provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The board of directors receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: Goldman Sachs Real Estate Finance Trust Inc


text: Vulnerability and penetration assessments are also conducted at least annually by an independent third party. In addition to a strong set of internal controls, the Company has implemented a robust due diligence process for third-party providers prior to executing an agreement. Risk assessments include evaluating the third party's security posture through intelligence feeds, SOC reports, ISO certifications, and self-attestation questionnaires. Third parties processing customer data are contractually required to meet all legal obligations for protecting against anticipated security threats to client data, protecting against unauthorized access to client data, and ensuring proper disposal of client data.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization designed to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such as systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sectors. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.

companyName: Greenbacker Renewable Energy Co LLC


text: Assessment of Cybersecurity Risk In the past three years, we have not experienced a material cybersecurity breach. Our Advisor, including our Response Team, and our management assess on an on-going basis the potential impact of risks from cybersecurity threats on us, and regularly evaluate how such risks could materially affect our business strategy, operational results, and financial condition. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, helps identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our executive management team, along with our managed information technology Service Provider, Strebe Corporation, a California corporation d/b/a Connetic ("Connetic"), is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with Connetic, which has provided information technology support, security audit and on-call services to financial industry participants for more than 25 years.

companyName: Peakstone Realty Trust

ticker: PKST


text: We rely heavily on our information technology (IT) systems across various aspects of our operations, from product development to customer relations. Given the innovative nature of our business, particularly in the realms of smart glass and fiber optics, ensuring the security, integrity, and availability of data is paramount. We operate in an environment where the protection of intellectual property and sensitive data, including proprietary technology information and customer data, is critical. We are therefore committed to a comprehensive cybersecurity strategy that encompasses not only compliance with relevant privacy laws but also proactive risk management.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: The CISO is appointed by the Chief Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The Cybersecurity Steering Committee has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy. The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.

companyName: Johnson Controls International plc

ticker: JCI


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Chief of Operations and Development, as well as our engineering operations and third-party service providers. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.

companyName: NeuroPace Inc

ticker: NPCE


text: The Audit Committee is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. The Audit Committee reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.

companyName: Veradigm Inc.


text: Our organization undergoes annual reviews by third-party consultants to help assess the implementation and operational effectiveness of the security controls implemented in our service environment which is in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC").

companyName: CANTALOUPE, INC.

ticker: CTLP


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CIO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes its CIO, who has 37 years of IT experience across various industries, including 32 years in manufacturing, and who is a member of the National Association of Manufacturer's Cybersecurity Advisory Council, and its Director of Cybersecurity, who has 28 years of IT experience, including seven years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: A vendor management program ensures third-party vendors and service providers adhere to the Bank's security, compliance, and operational standards to mitigate risks. This program involves assessing potential risks associated with vendors, such as data breaches, compliance violations, or operational failures, by conducting thorough due diligence and regularly monitoring vendor performance. It includes setting performance expectations, performing ongoing audits, and ensuring vendors implement necessary safeguards to protect the organization's sensitive data and maintain the availability of services. The goal is to ensure that third-party relationships do not introduce unacceptable levels of risk to the organization while maintaining business continuity and regulatory compliance.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: We maintain a cyber risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The design of our program is based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: STEM, INC.

ticker: STEM


text: Related to Cybersecurity Risks Our Senior Director of Information Technology (IT) is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has nearly 15 years of experience as an information technology professional.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees our management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.

companyName: VIASAT INC

ticker: VSAT


text: The CIO holds a B.S.B.A. degree in Management Information Systems and has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer for the Company. The Company's CEO, CFO and GC each hold undergraduate degrees in their respective fields, and collectively have over 50 years of experience managing risks at the Company and at similar companies.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats. The most-recent audit was performed in 2022 over the Company's 2021 cybersecurity program. The audit results showed that FMC has a mature and robust cybersecurity program that is rated at or above peer industry benchmarks and also provided insight for areas of future improvement in risk mitigation and further program development.

companyName: FMC CORP

ticker: FMC


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.

companyName: Chemours Co

ticker: CC


text: The CSO provides leadership, strategic direction, and oversight for NetApp's Global Security Risk and Compliance functions and security program. Global Security executives oversee management of risks and track projects progress, remediations, and any issues related to cybersecurity risks.

companyName: NetApp, Inc.

ticker: NTAP


text: Governance and Management Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director Cyber Security under the oversight of the Chief Information Officer. With over 20 years in the field of IT and cybersecurity, the Director, Cyber Security has significant professional experience including senior technical leadership roles along with consulting and management roles at public and private companies in the manufacturing, chemical and oil and gas sectors. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. He holds a masters in science degree from the University of Texas at Austin and professional certifications that include a CISSP and an active U.S. Government security clearance. Our Director Cyber Security oversees our cybersecurity governance programs and leads a team responsible for cybersecurity risk assessment, continuous monitoring for internal and external threats and vulnerabilities, remediation of known risks, and employee cybersecurity training.

companyName: Cornerstone Building Brands, Inc.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Processes for the Identification of Risks from Cybersecurity Threats The Compliance Committee, working with the Information Security Team, has developed a cybersecurity risk management program that aims to address the following key areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; • Approaches to mitigating and managing cybersecurity risks; and • A process for regular reporting to the Compliance Committee and Board of Directors (directly and through the Audit Committee).

companyName: TripAdvisor, Inc.

ticker: TRIP


text: While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization. Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS").

companyName: Murphy USA Inc.

ticker: MUSA


text: Risk Assessment and Strategy The Company regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors.

companyName: SOLESENCE, INC.

ticker: SLSN


text: At Cannae, the board of directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. Senior leadership, including our Chief Information Security Officer ("CISO"), works diligently to identify, assess and manage material risks through our Enterprise Risk Management ("ERM") program. As part of that program, we conduct risk assessments to identify and assess our material business, operational and environmental risks and works with our management team to develop strategies and plans to mitigate and manage those risks, including cybersecurity risks related to the use of third-party service providers.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: Centrus has policies, procedures, and strategies in place to assist in assessing and managing cybersecurity risks. To help safeguard the Company's network and information maintained on that network, the Company maintains and executes a cybersecurity program designed to monitor, prevent, detect, mitigate, and remediate cyberattacks.

companyName: CENTRUS ENERGY CORP

ticker: LEU


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Information Technology Director (IT Director) and Director of Information Security (IS Director). Our IS Director has over ten years of experience managing information security, developing cybersecurity strategy and implementing relevant and effective cybersecurity programs. Together, our IT Director and IS Director hold numerous credentials, including a Bachelor of Science in Cybersecurity & Information Assurance, Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Global Information Assurance Certification (GIAC), Certified Forensics Analyst (GCFA), GIAC Certified Incident Handler (GCIH), and others.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: We have a risk-based cybersecurity risk management program (the "Program") in place designed to assess, identify and manage material risks from cybersecurity threats. The Program falls under the oversight of our Chief Information Security Officer ("CISO") and defines controls for access management, data protection and vulnerability detection, in addition to incident response protocols which are discussed further in the "Governance" section herein. The Program incorporates customized elements from industry-leading standards to drive robust and comprehensive protection.

companyName: YUM BRANDS INC

ticker: YUM


text: the National Cyber Security Centre incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Innospec utilizes an external service to provide ongoing analysis of the security related to our critical third-party service providers for IT operations and business IT services. Innospec will use the information provided by this external service as part of its IT vendor selection criteria and for ongoing third-party risk management.

companyName: INNOSPEC INC.

ticker: IOSP


text: The Bank's cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.

companyName: Federal Home Loan Bank of New York


text: Ransomware attacks, in particular, have become more frequent and severe, potentially resulting in the encryption or theft of critical data, operational disruptions, and financial losses. A successful ransomware attack on our systems or those of our vendors could lead to prolonged business interruptions, regulatory fines, reputational damage, and substantial remediation costs. While we employ security measures designed to detect, prevent, and respond to such threats, no system is entirely immune from cyberattacks.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Star Holdings

ticker: STHO


text: a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Manager of Cybersecurity is our incident response team leader. In this position, our Manager of Cybersecurity oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Manager of Cybersecurity has nearly two decades of experience in cybersecurity management and policy, achieved through job training and higher education, and possesses a background in security and alignment of information technology solutions.

companyName: BTC Digital Ltd.

ticker: BTCT


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for DuPont's Board of Directors and management. The CIO and the CISO are primarily responsible for assessing and managing material risks from cybersecurity threats. The CIO has fifteen years of cybersecurity experience, including six years with DuPont, and the CISO has twenty-six years of cybersecurity experience, including one year with DuPont. Each of the CIO and CISO maintain industry recognized credentials relevant to their roles.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: If a cybersecurity risk is identified, Company's policy is to use vendors to assist the Company to identify, assess, and manage material risks from cybersecurity threats to corporate systems, which consulting firms may include consulting firms, external legal counsel, incident response vendors, auditors, monitoring technology, and cybersecurity data providers.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: Ensuring the security of Duke Energy's assets, information and teammates is vital for delivering the essential service on which Duke Energy's customers and communities depend. In light of the ever-evolving threat landscape and increasing sophistication of threat actor tactics, techniques and procedures, steadfast and sophisticated cybersecurity and security operations are integral parts of Duke Energy's enterprise risk management framework. Duke Energy's enterprise risk management framework is used across the enterprise by subject matter experts to identify, assess, monitor and communicate enterprise level risks to the Chief Risk Officer. Duke Energy's technology and cybersecurity risk management program is integrated into the Company's overall Enterprise Risk Management program and is composed of three primary lines of defense: (1) the Cybersecurity Incident Response Team (CIRT); (2) the Duke Energy Enterprise Security Team (EST); and (3) internal and external cybersecurity audits.

companyName: PROGRESS ENERGY INC


text: Technical Safeguards. The Company's Security Operations Center, led by our Vice President IT Risk Management (Chief Information Security Officer), constantly and proactively monitors our network and application landscape for threats and anomalies. The Security Operations Center deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: The Company adopted an Information Security Policy which governs the Company's management of information technology ("IT") systems, network, information, data and assets. HCSG's Information Security Policy is periodically reviewed based on the NIST Cybersecurity Framework. HCSG regularly monitors and measures the performance of its IT System and Assets and its Information Security Policy. HCSG has procedures to ensure that any of its vendors and suppliers that create, utilize, or process HCSG's data take a similar, risk-based approach to information security.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Our board of directors, through its Audit Committee, maintains oversight of risks, including cybersecurity risks, and receives an update from the Director of IT Security and the Chief Information Officer (CIO) at each quarterly committee meeting. The Audit Committee also reports to the full board on cybersecurity matters as part of its regular report out after each meeting. The Audit Committee Chair is immediately informed of any breach that could be more than de minimis and is kept apprised of any resulting investigation and is briefed on the substance of any Form 8 -K filing related to a material cybersecurity incident.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a dedicated third-party risk assessor, security risk reports, and formal business owner risk response.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: information security training program for all employees, including phishing awareness of third-party service providers to conduct assessments of the Company's cybersecurity risk management program, penetration testing, and vulnerability testing.

companyName: Electromed, Inc.

ticker: ELMD


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: iANTHUS CAPITAL HOLDINGS, INC.

ticker: ITHUF


text: Risk Management and Strategy NerdWallet, Inc. recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and that of our users.

companyName: NERDWALLET, INC.

ticker: NRDS


text: The Company engages with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing its cybersecurity risk management systems. This enables the Company to leverage specialized knowledge, experience and insights, to help ensure its cybersecurity strategies and processes remain current.

companyName: Sleep Number Corp

ticker: SNBR


text: Both the CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. The CIO has a bachelor's degree in Management Information Systems and an MBA from Oakland University, and was previously the Domain CIO at Comerica Bank. The CISO has a bachelor's degree in Computer Science from the University of Illinois, holds the CISSP, Certified in Risk and Information Systems Control and Certified Chief Information Security Officer certifications, and has been active in the management of the Company's security programs for more than a decade, serving in the CISO role since early 2023.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization for Standardization ("ISO") 27001 Information Security Management System Requirements. The Company will have a third party perform an annual assessment of the Company's cybersecurity risk management program against the NIST CSF. The Company has a Cyber Security Operations Center monitoring our global cybersecurity environment and coordinates investigations and remediation of alerts. We are enhancing our programs for staging incident response drills to prepare support teams in the event of a significant incident. The cybersecurity risk management program includes controls for organizational processes, personnel, physical facilities and equipment, and technological controls.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems and business operations, including vetting and managing third-party service providers with comprehensive due diligence, continuous monitoring and strict compliance with industry standards. In addition, we provide cybersecurity awareness training to our employees, incident response personnel, and senior management, including training on best practices for data privacy and security. Our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: The Company's cybersecurity environment is led by our information technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. The IT group is responsible for monitoring and managing the security of the Company's corporate network and enterprise systems, including technical controls, and safety protocols and responding to security threats.

companyName: US ENERGY CORP

ticker: USEG


text: Management has engaged third -party vendors to assist in monitoring our cybersecurity risk management programs and identifying and responding to any incidents. Additionally, third -party vendors are routinely engaged to evaluate how effectively management as a whole manages cybersecurity risk. This includes annual testing of our incident response plan through tabletop exercises and simulations to ensure readiness as well as penetration testing and security assessments. We also utilize third -party cybersecurity vendors to assess our protections against identified vulnerabilities, and we have implemented a third -party risk management process for key service providers, based on our assessment of their criticality to our operations.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We have experienced threats to our data and systems, including malware and computer virus attacks from time to time. To our knowledge, these threats have not materially affected us, our business, financial position, results of operations or cash flows to date. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors—Other Operational and Financial Risks."

companyName: Enhabit, Inc.

ticker: EHAB


text: The Company's Chief Financial Officer is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Toppoint Holdings Inc.

ticker: TOPP


text: Our cybersecurity processes are integrated into our overall enterprise risk management program and business continuity processes. In this regard, we address cybersecurity risks through a comprehensive, cross-functional approach across our technology, legal, compliance, finance, and other teams aimed at preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our enterprise risk management program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to management and to the audit committee of our board of directors. We also periodically review our cybersecurity risk with our entire board of directors.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Security Controls: Our approach to cybersecurity employs a multi-layered strategy, implementing a range of technical administrative and physical controls to safeguard critical systems and data. These controls encompass (i) firewalls, intrusion detection, and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activities, and protect network infrastructure; (ii) encryption, including secure protocols and multi-factor authentication, to secure information in transit and at rest; and (iii) a secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats. We also conduct regular security patching to mitigate emerging cyber threats proactively.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Cybersecurity Incident Monitoring The VP of Technology strives to be continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The VP of Technology has implemented industry tools and oversees the processes for the regular monitoring of our information and operational technology systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VP of Technology is equipped with an incident response plan (IRP). This comprehensive plan encompasses immediate actions like identification, containment, and eradication, mid-term objectives such as recovery, and long-term goals including forensic analysis and lessons learned. It also lists response parties as well as chain of command and reporting. We regularly test our incident preparedness through at least one annual drill and tabletop exercise. These activities simulate real-world attacks, allowing us to evaluate and refine our incident response plan. Drills focus on specific technical responses, while tabletop exercises involve key stakeholders walking through the response process to identify potential gaps. The insights gained from these exercises ensure our team is prepared to effectively respond to and recover from security incidents.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Our Director of Operations leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. The Director of Operations role is currently held by an individual who has over two decades of professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. In addition, our Director of Operations as well as leaders from our operations, finance, and legal departments, are responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to the audit committee of our board of directors. The audit committee of the board of directors provides oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. The audit committee provides regular updates to our board of directors regarding such oversight, including updates on the status of ongoing cybersecurity projects, the results of cybersecurity risk assessments, and the emerging cybersecurity threat landscape. Additionally, the board of directors reviews our enterprise risk management processes periodically and is notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: While we believe our current measures are robust, we recognize the dynamic nature of cyber threats and continually refine our approach to remain vigilant and responsive.

companyName: DNOW Inc.

ticker: DNOW


text: As of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected BlackLine, including its business strategy, results of operations or financial condition. Notwithstanding our investment in cybersecurity, however, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition.

companyName: BLACKLINE, INC.

ticker: BL


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, losses of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation," which disclosures are incorporated by reference herein.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: For additional information on our overall corporate governance structure and internal process of assessing our other significant risks, see the "Corporate Governance, Sustainability and Social Responsibility" section in Item 1. "Business." of this Form 10-K.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including various management personnel that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer. Various individuals that are part of the Cybersecurity Function, and our General Counsel, Chief Financial Officer and Chief Executive Officer, work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management processes include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: CS Disco, Inc.

ticker: LAW


text: Our management team takes steps to stay informed about and monitor supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats as well as challenges to our business from evolving information technology systems. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity risks such as network security, information and digital security, data privacy and protection, and risks related to emerging technologies such as generative artificial intelligence and machine learning, to help align our risk exposure with our strategic objectives.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team. Working cross-functionally with Legal, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.

companyName: Zevia PBC

ticker: ZVIA


text: Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report, we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors. Our Vice President of Finance and Administration has been designated as the lead for implanting our incident response plan. In addition, in 2024, we have acquired a cybersecurity insurance policy.

companyName: EON Resources Inc.

ticker: EONR


text: Cybersecurity risk management is integrated with our overall enterprise risk management framework. Identified cybersecurity risks are reported through established channels to relevant stakeholders, including senior management and the Board of Directors. Mitigation strategies are prioritized and incorporated into the overall risk management plan. We continuously identify and evaluate potential cybersecurity threats. While the nature of cyber threats makes it impossible to predict all future incidents, some currently identified material cybersecurity risks include: • Ransomware attacks that could disrupt business operations and lead to data breaches. • Phishing attacks that could compromise employee credentials and provide unauthorized access to sensitive data. • Supply chain attacks targeting third-party vendors with access to our systems or data.

companyName: C3.ai, Inc.

ticker: AI


text: A key area for the Cybersecurity Program is employee cybersecurity education. The Company's employees play a key role in cybersecurity and receive mandatory cybersecurity training, phishing attack simulations, educational events, and news bulletins. The Company's data protection and privacy program is designed to adhere to and adapt to global privacy and data protection laws.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy for assessing and managing material risks from cybersecurity threats. Our current CISO has over 25 years of cybersecurity experience across a wide array of industries, most recently serving in leadership positions at two different public companies and previous roles of increasing responsibility at multinational technology companies. Our CISO reports directly to our Chief People and Digital Technology Officer, who is a member of our Executive Committee and reports to our Chief Executive Officer.

companyName: Moderna, Inc.

ticker: MRNA


text: All employees received cybersecurity training and other education regarding their use of computers, information technology, and sensitive data including specifically how to recognize common attack strategies. As many of our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risk from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity."

companyName: FuboTV Inc.

ticker: FUBO


text: We have established a permanent management position of Director of Cybersecurity and IT Governance that reports directly to the Chief Financial Officer. Our current Director of Cybersecurity and IT Governance, has an undergraduate degree in computer science and is a Certified Information Systems Security Professional. He possesses over 20 years of IT experience with more than 10 years in managerial positions and has been actively involved in IT security related projects, initiatives, audits and associated program management in the last seven years. As part of our cybersecurity incident response plan, we have established a dedicated incident response team to assess and manage risks arising from cybersecurity threats, consisting of our Director of Cybersecurity and IT Governance and various members of senior management, including our Chief Financial Officer and General Counsel.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: Material Effects of Cybersecurity Incidents We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. To learn more about risks from cybersecurity threats, review the risk factors included in Part I, Item 1A Risk Factors in this Annual Report on Form 10-K, as updated by WTW's subsequent SEC filings. The risks described in such filings are not the only risks facing WTW. Additional risks and uncertainties not currently known or that may currently be deemed to be immaterial also may materially adversely affect WTW's business, financial condition or results of operations.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: environments are isolated using credentials and accounts are following a plan to ensure scheduled patching, upgrades, and other maintenance occur every quarter. This includes updates for have the capability to search our logs for security incidents are on schedule to monitor every public endpoint using a Web Application Firewall (WAF), ensuring that all traffic is logged with patterns to detect any suspicious behavior aim to enable automatic processes to ensure no production data is changed without systematic audits data visualization tool has login credentials with role-based access 3) Management's Role: Our board of directors has ultimate oversight of cybersecurity risk. Our VP of Engineering and Platform Engineering Manager lead cybersecurity risk assessment and management efforts, collaborating closely with the interim CEO for guidance, strategic direction, alignment with business objectives, and environment.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of IT who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process. We have a dedicated IT resource with expertise in cybersecurity and risk management who is dedicated to working with our internal IT team on cybersecurity risk management.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Depending on the environment and system, the Company implements and maintains various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan, monitoring and response services in certain environments and systems, system access controls for certain systems, an employee cybersecurity training program, asset management and recovery processes, penetration testing, dark web monitoring, monthly environment risk reviews, external threat intelligence reports, regular digital infrastructure scans, internally reported threats, and cybersecurity insurance.

companyName: TerrAscend Corp.

ticker: TSNDF


text: To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these safeguards include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize certain application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs for our personnel.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Crane Company was separated from its parent company, Crane Holdings, on April 3, 2023, and since the separation and during the preceding 5 years as Crane Holdings, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. The Company maintains cyber risk and related insurance policies as a measure of added protection.

companyName: Crane Co

ticker: CR


text: The Company leverages internal and external auditors to periodically review information technology and information security policy, processes, and controls to ensure they meet regulatory compliance and operate effectively. Independent penetration testing is performed annually.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: We conduct regular, proactive cybersecurity vulnerability assessments to identify opportunities for improvement and reduce exposure to cybersecurity incidents. We also conduct regular cyber incident simulations and undergo internal and external audits of our processes. We participate in industry organizations, engage third-party service providers, and maintain close working relationships with law enforcement agencies to help us identify and address the latest cybersecurity threats.

companyName: SOUTHWESTERN ENERGY CO


text: Helios IT management is responsible for developing and implementing its cybersecurity policies and is comprised of individuals with either formal education in information technology or cybersecurity or have relevant experience working in information technology and cybersecurity. Additionally, leaders in Helios' information technology function receive periodic training and education on cybersecurity related topics including certifications.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: The Audit and Risk Committee assists the Board of Directors in its responsibilities of overseeing cybersecurity risk. Our Chief Operating Officer ("COO") and Chief Information Security Officer ("CISO") play a pivotal role in informing the Audit and Risk Committee on cybersecurity risks. They report to the Audit and Risk Committee on a quarterly basis on a broad range of topics, including assessments and scoring of our information security program; incident management, the incident response plan and the status of security tools; the current cybersecurity landscape and emerging threats; and the status of ongoing cybersecurity awareness and training and projects to strengthen our information security systems. Additionally, our Executive Director, Internal Audit presents a quarterly report on our enterprise risk management activities, including cybersecurity risks, to the Audit and Risk Committee. The chair of the Audit and Risk Committee, in turn, periodically reports on its review with the Board of Directors, and our COO and CISO report annually to the Board of Directors regarding our cybersecurity program and risk management.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our IT and related systems are critical to the efficient operation of our business and essential to our ability to perform day to day processes. We face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential or otherwise proprietary information, or that of our employees, via phishing/malware campaigns and other cyberattack methods.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets including for example (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, (4) policies and procedures to manage how Information Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Our cybersecurity program is built upon industry standards and we have deployed sophisticated software both from internal and external sources to mitigate cybersecurity threats. We identify security threats through internal audits of our systems. We also require any service providers to provide System and Organizational Control ("SOC") type reports to ensure that data is secure and our duty to protect information is fulfilled.

companyName: Universal Token

ticker: UTKN


text: As of December 31, 2023, we have not experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Axonics, Inc.


text: Reporting to the Board of Directors. Our COO and CISO report to the audit committee at least quarterly about the detection, prevention, mitigation and remediation of cybersecurity events, including information about the latest cybersecurity threats, the status of our prevention and detection measures and the effectiveness of our mitigation and remediation efforts, as well as any other cybersecurity risk management activities and the progress of related projects. These briefings include updates on the formalized incident response plan, communications and escalation procedures. Management will apprise the board of directors of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Principal Accounting Officer. Our Principal Accounting Officer receives regular reports on the status of our cybersecurity measures, and works with the Company's incident response team in an effort to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and to assess and determine materiality for reporting purposes.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Sponsor will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: We have implemented cybersecu rity and data protection policies and procedures to assess, identify and manage risks from cybersecurity threats. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive awareness notices and are informed about new email threats and recent phishing attempts and email frauds. We have capable employees with significant expertise in cybersecurity related to our industry. We evaluate, create and deploy advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. We also engage third -party service providers and consults to support our cyber risk management efforts, including through periodic security testing.

companyName: TABLE TRAC INC

ticker: TBTC


text: Governance of Cybersecurity Risk Management Our Board of Directors holds collective oversight responsibility for our strategic and operational risks. Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management. The Audit Committee provides periodic reports on these reviews to the full Board of Directors.

companyName: Rocket Lab Corp

ticker: RKLB


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for information on cybersecurity risks that may materially affect our business strategy, results of operations and financial condition.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology ("NIST") and the Crypto Currency Security Standard ("CCSS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

companyName: American Bitcoin Corp.

ticker: ABTC


text: The CISO and executive management play a pivotal role in informing the Audit Committee on cybersecurity risks. Executive management, including the CISO, regularly meets with the Audit Committee to discuss cybersecurity risks, review quarterly cyber metrics and oversee progress against our annual action plans. These briefings may encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and executive management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.

companyName: Civeo Corp

ticker: CVEO


text: To date, no cybersecurity incident has resulted in any material impact on our business, operations or financial results or our ability to service our customers or run our business. Refer to Item 1A Risk Factors for additional discussion of risks associated with cybersecurity threats to the Company.

companyName: XEROX CORP


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.

companyName: NESTOR PARTNERS


text: The Company has implemented a comprehensive set of cybersecurity policies and procedures designed to mitigate risks and protect our information assets. These policies cover areas such as:

companyName: HG Holdings, Inc.

ticker: STLY


text: Board of Directors The Board of Directors (the "Board") has the primary responsibility for oversight of cybersecurity matters. This responsibility had been previously delegated to the Audit Committee. The Board regularly reviews compliance and disclosure control procedures for cybersecurity matters. The Board also receives quarterly briefings from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and Senior Vice President, General Counsel and Secretary (the "General Counsel"), as well as third-party cybersecurity advisors, on the Company's cybersecurity program, including data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: We provide regular mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We also publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.

companyName: BOYD GAMING CORP

ticker: BYD


text: Cybersecurity Incident Response Process Our incident response plan outlines the steps we take to prepare for, detect, respond to, and recover from cybersecurity incidents. This process includes assessing severity, escalating, containing, investigating, and remediating incidents, while ensuring compliance with applicable legal obligations and protecting our brand reputation. As part of this process, we regularly engage with third-party assessors and consultants to review and improve our cybersecurity program, focusing on compliance and areas for improvement. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity specific risk identification program, both of which are discussed above.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: To manage our cybersecurity risk, we practice cyber hygiene through, among other measures, identity and access management, vulnerability and patch management, and asset management programs. We also segment our informational and operational technologies, and leverage network micro-segmentation and combine this practice with zero-trust security concepts. Operationally, we continuously monitor for cyber intrusions and augment our internal resources and capabilities with third-party service providers. Multiple security technologies are employed to protect our systems, applications, and data, including next generation firewalls, multi-factor authentication and access controls, and endpoint detection and response solutions. We have integrated our cloud-hosted services with our security operations center and have implemented measures aimed at securing our remote workforce. We measure our cybersecurity practices against the National Institute of Standards and Technology Cybersecurity Framework, relevant industry standards, and government regulations. We routinely engage independent third-party security firms to exercise and assess our cybersecurity capabilities.

companyName: Midstream Co LLC


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect intrusions such as identity attacks. Engagement of a provider for real-time threat detection, alerting and immediate, automated remediation service for the entire organization.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Saia maintains cybersecurity processes, technologies and controls to help us assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of Saia's overall enterprise risk management process. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats.

companyName: SAIA INC

ticker: SAIA


text: The Company's CISO has over 28 years of experience building and operating enterprise security functions, security engineering, and security governance and program management. Prior to joining the Company, the CISO managed an Information Security and Risk Management program within a Fortune 500 energy company that handled a wide variety of information security issues including industrial control system security. The CISO has also served on the board of several academic institutions, professional service organizations, and local non-profits and contributed on many special committees for cybersecurity initiatives.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: The Company's data protection and privacy program is designed to help it assess, identify, manage, and mitigate risks relating to cybersecurity threats and incidents. The Company designs its cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security, Inc (CIS) Controls, as guides in supporting its ability to perform such functions.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: CTO and the MSP will engage in the periodic assessment and testing of CTO's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts will include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of CTO's cybersecurity measures and planning. The MSP regularly assesses CTO's cybersecurity measures, including information security maturity, and regularly reviews CTO's information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and CTO will adjust its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected.

companyName: Gold Flora Corp.

ticker: GRAM


text: Despite the security measures we have implemented, certain cyber incidents could materially disrupt operational systems. If our IT resources are compromised by an intentional attack and results in loss of trade secrets or other proprietary or competitively sensitive information; compromise personally identifiable information regarding customers or employees; delay our ability to deliver products to customers; jeopardize the security of our facilities; or cause other damage. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. We continuously seek to maintain a robust program of information security and controls, but the impact of a material cybersecurity incident could have an adverse effect on our competitive position, reputation, results of operations, financial condition, and cash flows. Additionally, while we have a cybersecurity program designed to protect and preserve the confidentiality, integrity, and availability of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. Although we maintain cybersecurity insurance, there can be no guarantee that our insurer(s) will cover specific claims, pay the full costs of an incident, or provide payment in a timely manner. For more information, please see "Item 1A – Risk Factors – Risks Specific to Our Company and Strategy-Our business relies significantly on the use of information technology. A significant disruption to our operational technology or those of our business partners, a privacy law violation, or a data security breach could harm our reputation and/or our ability to effectively operate our business, and our financial results."

companyName: Crocs, Inc.

ticker: CROX


text: When the Company experiences a cybersecurity incident, the Director of Technology will inform the Cybersecurity Committee, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and, in particular, whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors provides oversight of the Company's response to such incident, including considerations around disclosure of the event. The Cybersecurity Committee continuously monitors incidents as they are remedied to ensure proper remediation and, if necessary, the ability to report to the Board of Directors if previously unknown material information arises during such remediation.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: We design and assess our program generally based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Although our program may not meet the technical requirements of the NIST CSF, we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Additionally, as we accept credit cards as a form of payment, we consider the requirements of the Payment Card Industry Data Security Standards (PCI DSS) in relation to our program.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We face a number of cybersecurity risks in connection with our business. From we have identified cybersecurity threats and cybersecurity incidents that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations, and financial condition.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: In addition, we use a variety of third-party service providers to support and execute on our Security Program. These third parties provide cybersecurity consulting services, cybersecurity software, penetration testing, audits, and other professional services to aid us in identifying, assessing, and managing risks from cybersecurity threats.

companyName: SPS COMMERCE INC

ticker: SPSC


text: The Company's technology staff and CISO conduct weekly meetings to review: (i) implementation of new security measures, (ii) results of existing technical system monitoring tools to identify any potential risk and propose remediation, as necessary; (iii) newly disclosed software patch updates to assess risks and set patch implementation priorities; and (iv) threat intelligence from various organizations, such as the Cybersecurity and Infrastructure Security Agency, to assess risks and suggest security measures, as necessary. Cybersecurity risk is also included in the Company's Enterprise Risk Management ("ERM") process that involves senior management and other personnel in the identification, assessment and management of a broad range of risks (including cybersecurity risks) that could affect the Company's ability to execute on its corporate strategy and fulfill its business objectives. The Company's Chief Operating Officer and Chief Information Officer provide input and updates to the Enterprise Risk Committee (comprised of members of management) on cybersecurity preparedness and emerging risks. The Enterprise Risk Committee produces the relevant risk management information for executive and senior management and the Board Ambac Financial Group, Inc.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG