text: The Board is supported by the Cybersecurity Risk Committee, a specialized group that includes senior executives and departmental representatives from IT, legal, human resources, and operations. This committee is charged with the development of cybersecurity policies, evaluation of defense mechanisms, and oversight of the company's response to cyber incidents.

companyName: Urgent.ly Inc.

ticker: ULY


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we could from time to time, experience threats to and security incidents related to our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "We may be unable to adequately protect our information technology systems from cyberattacks, cyber intrusions or otherwise which could result in damage to our information technology systems and unauthorized disclosure or use of confidential or proprietary information, including personal data" in Item 1A- Risk Factors.

companyName: Tango Therapeutics, Inc.

ticker: TNGX

secItem: Item 1C


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. We have developed an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the board of directors and our management. The program is designed to identify and assess risks most critical to our success including through an analysis of the likelihood of occurrence and potential impact of each risk. The executive leadership team, including our Chief Executive Officer, and our management team, comprised of department leaders and subject matter experts, are responsible for identifying, assessing, managing and mitigating risks with Board appropriate oversight.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: External partners are a key part of the Company's cybersecurity infrastructure. XPEL partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise to control and monitor its processes.

companyName: XPEL, Inc.

ticker: XPEL


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the board of directors, in collaboration with relevant information technology personnel, insurance providers, legal counsel and, when necessary, external cybersecurity firms specializing in forensic investigations.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: The Company engages external third-party security assessment vendors, both on a recurring basis and as needed, to perform realistic adversarial threat attacks (penetration testing) on our internal and external environments leveraging the International Organization for Standardization (ISO) cybersecurity frameworks. These third-party experts provide impartial, objective, and strategic evaluations of our cybersecurity posture, identifying critical vulnerabilities and recommending improvements.

companyName: CROWN HOLDINGS, INC.

ticker: CCK


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Head of IT who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Our cybersecurity risk is affected by cyber threats that are proliferating and advancing in their ability to identify and exploit vulnerabilities, requiring continuous evaluation and improvements to our security architecture and cyber defenses. We also face increased cybersecurity risk as our Sponsor and Advisor deploy additional mobile and cloud technologies. They are continuously hardening their infrastructure built on these technologies, monitoring for threats, and evaluating their capability to respond to any incidents to minimize any impact to their systems, data, or business operations, including those that impact us. Because our Sponsor services clients across multiple industry verticals many of which are higher-profile cyber targets themselves including financial services, technology, government institutions, healthcare and life sciences, this also may increase the risk that they and we are subject to cyber-attack incidents.

companyName: JLL Income Property Trust, Inc.


text: We build and evaluate our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The NIST CSF offers a thorough set of guidelines and best practices to help us establish a strong cybersecurity posture. Utilizing the NIST CSF enables us to systematically identify, assess, and manage cybersecurity risks pertinent to our business operations. However, it's important to highlight that using the NIST CSF as a guide does not imply that our cybersecurity program meets any specific technical standards, specifications, or requirements.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: The information technology and security committee is responsible for providing oversight and leadership for our information technology security and cybersecurity, planning processes, policies and objectives. The information technology and security committee is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.

companyName: CORPAY, INC.

ticker: CPAY


text: The Audit Committee receives regular reports from the Chief Information Officer ("CIO") on our cybersecurity risks. In addition, the CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: The Company engages cybersecurity assessors and consultants, including third party auditors, to perform annual penetration testing and risk assessments. These external parties provide validation of our processes and controls, ensuring they meet industry best practices and regulatory standards.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Digital Turbine, Inc.

ticker: APPS


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company.

companyName: RYTHM, Inc.

ticker: RYM


text: The Company's Board of Directors, including its Audit Committee, provides oversight of the Company's risks from cybersecurity threats. Management, including the CEO, CFO and IT personnel, presents formal reports to the Audit Committee and to the full board at least annually, as well as whenever cyber events warrant update.

companyName: RGC RESOURCES INC

ticker: RGCO


text: The Partnership has established incident response procedures to be followed in the event of a cybersecurity incident that is overseen by the Partnership's Chief Executive Officer and Chief Financial Officer. The Chief Executive Officer and the Chief Financial Officer are notified of cybersecurity incidents as soon as the Partnership receives notification from a third-party service provider or is informed by other means, and will determine if additional internal and/or external resources are needed to evaluate, mitigate, and remediate the cybersecurity incident. At a minimum, the Board of Managers will be notified of material cybersecurity incidents prior to any public announcement and will receive updates on material developments and remediation activities.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Regular penetration testing, conducted by independent firms, forms a crucial part of our risk assessment process. These tests help us identify and mitigate potential vulnerabilities in our network security and data handling practices. Additionally, the Company monitors alerts and advisory statements from the Cybersecurity and Infrastructure Security Agency to keep abreast of relevant threats, vulnerabilities or alerts from actual incidents.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Our EMT receives periodic briefings, and the Board of Directors and its Audit Committee receives annual and quarterly briefings, respectively, on cybersecurity matters. These briefings may include updates on critical information security and cybersecurity risks and the threat landscape; cybersecurity improvement initiatives and the internal control environment; and, if relevant, the status of actions taken with respect to any cybersecurity incidents.

companyName: Hillenbrand, Inc.

ticker: HI


text: On an annual basis, the Board of Directors and the Audit Committee of the Board of Directors discuss the Company's approach to cybersecurity risk management, as well as our overall risk management strategy, with the members of senior leadership, which includes the Company's CISO, Chief Executive Officer, and Chief Financial Officer. The Audit Committee also receives periodic updates on risk management and enterprise risk management, including cybersecurity, throughout the year.

companyName: ACUITY INC. (DE)

ticker: AYI


text: We maintain incident response plans that guide our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. These plans cover the range of activities we undertake in connection with responding to cybersecurity incidents, including assessment, investigation, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: Our BISO, CRO/CISO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and all maintain several industry licenses and certifications through continuing professional education.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We have established policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cyclo Therapeutics, Inc.


text: The Corporation's Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation's risks from cybersecurity threats. The CISO is an active Certified Information Security Systems Professional and has been with the organization for 18 years with over 21 years of experience in technology infrastructure and security.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which, evaluates and assesses top risks to the enterprise on a periodic basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's risk assessment is presented to the Board of Directors. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with the use of third-party software and service providers. Such providers are subject to security risk assessments at time of onboarding, contract renewal and upon detection of an increase in risk profile. On an annual basis we review System and Organization Controls (SOC) 1 or SOC 2 reports for third-party service providers deemed significant to our environment.

companyName: AtriCure, Inc.

ticker: ATRC


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. While we remain vigilant, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in "Item 1A. Risk Factors—Risks Relating to Our Business and Operations—We are increasingly dependent on information technology, and our business and reputation could suffer if we are unable to protect our information technology systems against, or effectively respond to, cyberattacks, other cyber-incidents or security breaches or if our information technology systems are otherwise disrupted," which should be read in conjunction with the foregoing information.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: We engage third-party service providers to assist us with our cybersecurity risk management, including for network monitoring, antivirus protection, and managing IT environments. We have also engaged third party advisors and consultants to conduct periodic testing of our processes and systems. Before contracting with certain third parties, such as those that have access to our IT networks, we have a process to conduct diligence on those third parties, which includes a security assessment. We have also implemented a process for employees to undergo cybersecurity training during onboarding, and thereafter, on an annual basis as part of our larger compliance training program.

companyName: TELA Bio, Inc.

ticker: TELA


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: The Company's Board of Directors (the "Board") is responsible for the oversight of all risk management activities, including cybersecurity risk. The Board has delegated that oversight responsibility to the Audit and Risk Committee. The Audit and Risk Committee has delegated the responsibility to advance and monitor the overall effectiveness of the Company's risk management activities, including cybersecurity risk, to the ERM Committee. The ERM Committee also has the authority to direct effective and timely implementation of actions to address emerging cybersecurity risks. The ISSB provides quarterly reports to the Operational Risk Management Committee and ERM Committee. Through reports received from the ERM Committee, the Audit and Risk Committee notifies the Board of Directors about new policies and policy changes, changes in standards applied, and key risk metrics to evaluate ongoing cybersecurity threats and security risk exposure (the "Governance Model"). In addition, the ISSB provides a full report on the Company's cybersecurity framework, risks, initiatives, and significant incidents to the Audit and Risk Committee or the Company's Board of Directors not less than annually.


text: Notwithstanding the deliberate approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems, networks, and data systems. Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Information Security Team and Governance.

companyName: GARTNER INC

ticker: IT


text: FIS takes actions to assess, identify, and manage risks from cybersecurity threats to our information systems and those of our vendors and technology partners. A significant focus of our ongoing efforts is how we identify these vulnerabilities and prevent and respond to cyberattacks. Our processes include the activities of the FIS Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. They also include structured defense-in-depth initiatives, such as perimeter security, remote access security, endpoint security, application security and identity management. In addition, we engage in extensive information security training of our employees who use and access our information systems. Our process for identification and management of risks from cybersecurity threats includes regular communication with cyber experts, engagement of cybersecurity partners to review our systems, regular audits of our information security by third-party assessors and consultants, and regular interactions with vendors and technology partners to oversee and identify material risks associated with the information systems utilized by such persons.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.

companyName: OPEN TEXT CORP

ticker: OTEX


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: Information Services Group Inc.

ticker: III


text: The VP of IT is promptly informed of potential cybersecurity risks, threats and vulnerabilities by the Company's IT security team or the Company's SIEM partner. Once an incident has been identified, the VP of IT and the IT security team assess the criticality and impact of the incident on the Company's business operations. The VP of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the Audit Committee on all material incidents.

companyName: DallasNews Corp


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. IT leadership reports to our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. We promote a company-wide culture of cybersecurity risk management.

companyName: Ainos, Inc.

ticker: AIMD


text: Ensuring the security of Duke Energy's assets, information and teammates is vital for delivering the essential service on which Duke Energy's customers and communities depend. In light of the ever-evolving threat landscape and increasing sophistication of threat actor tactics, techniques and procedures, steadfast and advanced cybersecurity and security operations are integral parts of Duke Energy's enterprise risk management framework. Duke Energy's enterprise risk management framework is used across the enterprise by subject matter experts to identify, assess, monitor and communicate enterprise level risks to the Chief Risk Officer. Duke Energy's technology and cybersecurity risk management program is integrated into the Company's overall Enterprise Risk Management program and is composed of three primary lines of defense: (1) the Cybersecurity Incident Response Team (CIRT); (2) the Duke Energy Enterprise Security Team (EST); and (3) internal and external cybersecurity audits.

companyName: PROGRESS ENERGY INC


text: External auditors regularly review LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent review of the capability maturity of LiveRamp's security program.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: The Company engages third-party risk security vendors to identify, mitigate, and remediate cybersecurity risks. A third-party vendor is utilized to perform quarterly scans of all our network endpoints. Any issues identified by the scans are remediated. Annual penetration tests are conducted, which simulate real-world threats, including social engineering threats, to the Company's network and other digital assets. These tests include comprehensive "Dark Web" searches of all domain user emails. We require the annual submission of SOC 1 security certificates from third-party vendors that provide systems underlying our financial reporting infrastructure or with access to our financial and sales data.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.

companyName: Disc Medicine, Inc.

ticker: IRON


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties with whom we work, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."

companyName: Cardlytics, Inc.

ticker: CDLX


text: Collaborative Approach: CTO has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, the Audit Committee, and the Board in a timely manner.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber related risks. The Audit Committee, which is comprised of entirely independent directors, oversees our (i) information security policies, including periodic assessment of risk of information security breach, training program, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.

companyName: Century Communities, Inc.

ticker: CCS


text: The IT Committee and Audit Committee actively participate in discussions with management regarding cybersecurity risks. The IT Committee and Audit Committee perform an annual assessment of the Company's cybersecurity program, which includes a discussion of management's actions to identify and detect threats, and scenarios for potential response or recovery situations. In addition to regularly scheduled meetings, the IT and Audit Committee and appropriate levels of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our management team, including the CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CIO reports the progress of cyber risk reduction initiatives to the Audit Committee on a periodic basis. The CIO has extensive information technology experience in the corporate environment.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our cybersecurity risk management approach and processes are designed to manage risks from cybersecurity threats associated with our use of third-party service providers, ranging from vendor cyber vetting to conducting security assessments and monitoring activities. We also operate an employee awareness and training program to help ensure all relevant associates are equipped to recognize and respond to potential threats. Additionally, we leverage threat intelligence technologies to inform our response posture to potential emerging threats to our digital business infrastructure and systems. Furthermore, we engage with third-party cybersecurity consultants and technology vendors to assess our cybersecurity program and test our technical capabilities. The Company also carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our CISO. Guy Shamilov, our CISO for the last eight years, has been a chief information security officer for nine years and is certified by Certified Information Systems Security Professional (CISSP), among other technical certifications he holds with respect to cybersecurity. He has worked over the last twenty years in the security industry, and prior to working with us, he was CISO of Tata Consultancy Services, Deputy Chief Information Security Officer of Traiana, Information Security Manager of Logic Industries, Senior Information Security Specialist of Migdal Group and Information Security and System Administrator at Matrix. Our CISO oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Board, the Senior Information Officer ("SIO") and Management actively assess the Company's cybersecurity and data privacy risk management practices with the goal of being proactive rather than reactive. The Board and the Senior Information Officer and Management regularly review the Company's cybersecurity and data privacy risks, including our policies, controls and procedures for identifying, managing and mitigating such risks. The Board receives periodic reports from our SIO and other members of Management to the extent their relevant areas are impacted, regarding cybersecurity and data privacy measures and procedures, the identification of security gaps and compliance with applicable cybersecurity and data privacy regulations. The Senior Information Officer then briefs the Board at scheduled meetings regarding cybersecurity and data privacy developments. Management and the SIO are responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Investview, Inc.

ticker: INVU


text: The Board of Directors overall, including the Board Risk Committee more specifically, oversees cybersecurity risk. The Executive Committee overall, and the Chief Legal Officer, Chief Technology Officer, and Information Security Manager more specifically, manages cybersecurity risk and the associated programs at the operational level. Regular updates on cybersecurity are provided to the Management Risk Committee, to the Board Risk Committee and/or the Board of Directors.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: As a result, the Company has developed and maintains an Information Security Program ("ISP") and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program. The ISP establishes control requirements for addressing cybersecurity risks, defines stakeholder roles and responsibilities, and sets the foundation for the program's importance within the Company. We structure our ISP around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In alignment with recommendations from NIST and other relevant industry guidelines, the Company maintains a layered cybersecurity strategy based on prevention, detection, and response/mitigation. Internal and third-party contracted technical and procedural controls include, among others, the following types: preventative (including firewalls, end-point detection and response, data loss prevention, access controls, internal/external penetration testing); detective (such as security monitoring and event management); and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program that is integrated into an overall enterprise incident response/crisis management program).

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: As an externally managed company, we rely on the Adviser and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of the Adviser's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer, who periodically reports, among others, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the organization, including the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.

companyName: TPG Twin Brook Capital Income Fund


text: Product Cybersecurity The Company's Product Cybersecurity team, led by the Chief Technology Officer (the "CTO"), is responsible for assessing and managing the Company's cybersecurity risk as it relates to Aptiv's product portfolio. Risks are identified through threat intelligence, security testing, including penetration testing, audits and other processes defined by the Company's product cybersecurity GRC program. The processes by which the Product Cybersecurity team manages automotive product security risks have been audited, assessed and certified as compliant with various applicable international regulatory standards by independent third-party auditors.

companyName: Aptiv PLC

ticker: APTV


text: The Board of Directors recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board of Directors (the "Board") undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by company management at each of the ESG Committee's meetings on the status and developments of the cybersecurity program.

companyName: NOVANTA INC

ticker: NOVT


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: We also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our information security processes. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Bark, Inc.

ticker: BARK


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: TechnipFMC plc

ticker: FTI


text: The Company's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include, depending on the incident's classification and other circumstances, the CEO, CFO, COO and CLO, the Audit Committee, the Disclosure Committee, and internal and external counsel. In addition, the incident response plan considers communications and reporting to tenants, regulators and law enforcement.

companyName: American Homes 4 Rent

ticker: AMH


text: IT Cybersecurity Committee. As part of our cybersecurity governance framework and for purposes of establishing and maintaining our ISSP, we have established an IT Cybersecurity Committee (ITCC), which consists predominantly of members of our management team and IT department. The ITCC is subject to oversight by the Service Center Board, the Risk Committee, and the Board. The Risk Committee of the Board works directly with the ITCC to develop and implement our policies and procedures concerning cybersecurity and data protection. As stated in the Risk Committee Charter, our Risk Committee reviews management reports on the adequacy of our data-governance activities and IT security program; evaluates risks related to customer information, significant outsourcing with third parties or Vendors, and operational outsourcing arrangements; reviews, evaluates, and updates our data-governance framework, processes, and systems for identifying, assessing, and managing data risks that impact critical business operations; and reviews and evaluates our overall risk-management framework.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.

companyName: Quanterix Corp

ticker: QTRX


text: Our Information Security committee oversees this cybersecurity program and consists of senior management, including our CDIO, Chief Financial Officer and Chief Administrative Officer and General Counsel. At least quarterly, this committee reviews updates regarding cybersecurity threats and incidents that have occurred. Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CISO.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: Our Head of Information Technology ("IT"), with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our CIO provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: In conjunction with third-party vendors and consultants, we perform a variety of periodic risk assessment initiatives to gauge the performance of the Cybersecurity Program, to estimate our risk profile, and to assess compliance with relevant regulatory requirements. We perform periodic assessments of control efficacy through our internal risk and control self-assessment process, a variety of cyber event simulation exercises focused on the effectiveness of our incident response and crisis management procedures, and external technical assessments, including external penetration tests and "red team" engagements where third parties test our defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Risks and the Impact on our Company Due to the continuously evolving series of laws and regulations related to cybersecurity, data protection and privacy that are applicable to our business, as well as the associated risks from cybersecurity threats, we have expended significant resources in order to protect our information systems and data. We regularly review, monitor and implement multiple layers of security measures through technology, processes and our people. We utilize security technologies designed to protect and maintain the integrity of our information systems and data, and our defenses are monitored and routinely tested internally and by external parties. Despite these efforts, our facilities and systems and those of our third-party service providers may be vulnerable to privacy and security incidents; security attacks and breaches; acts of vandalism or theft; computer viruses and other malicious code; coordinated attacks by a variety of actors, including, among others, activist entities or state sponsored cyberattacks; emerging cybersecurity risks; cyber risk related to connected devices; misplaced or lost data; programming and/or human errors; or other similar events that could impact the security, reliability and availability of our systems. Internal or external parties have attempted to, and will continue to attempt to, circumvent our security systems, and we have in the past, and expect that we will in the future, defend against, experience, and respond to attacks on our network including, without limitation, reconnaissance probes, denial of service attempts, malicious software attacks including ransomware or other attacks intended to render our internal operating systems or data unavailable, and phishing attacks or business email compromise. While we have experienced cybersecurity incidents in the past, to date none have had a material impact on our business, results of operations, financial condition and cash flows.

companyName: DAVITA INC.

ticker: DVA


text: Risk Monitoring. Management and our Board monitor cybersecurity and data protection developments, including new or forthcoming changes to the legislative and regulatory landscape as well as Advanced Energy's cybersecurity processes, investments, and actions as described below.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. SUNOPTA INC.

companyName: SunOpta Inc.

ticker: STKL


text: AFG has designed its ERM program to reinforce the way the Company operates its business and reflects its culture, organizational structure and risks. The AFG Enterprise Risk Committee ("ERC"), consisting of AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's General Counsel and Great American Insurance Company's President, oversees the ERM process including risk identification, risk impact and mitigation strategies. Each member of the ERC directly reports to AFG's Co-CEOs. On a day-to-day basis, the Company's ERM process is overseen by an AFG Enterprise Risk Officer, who regularly meets with senior leaders, including the CISO, representing key areas throughout the organization. Cybersecurity risk has been identified as a significant risk monitored under the ERM program. In addition, Ms. Murray, one of AFG's independent Directors, completed the National Association of Corporate Directors' Cyber-Risk Oversight Program and received the CERT Certificate in Cybersecurity Oversight issued by the Software Engineering Institute at Carnegie Mellon University.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our Senior Vice President and Chief Innovation Officer, who has served in various senior leadership roles in operational improvement and technology during his nearly 30-year tenure with us, leads our innovation and technology initiatives, corporate information systems and financial shared services. Our cybersecurity risk management and strategy processes described in "Risk Management and Strategy" above are led by our Chief Information Officer (CIO) and our Chief Information Security Officer (CISO). Our CIO and CISO each report to our Chief Innovation Officer. Our CIO is responsible for the strategy, deployment, operational effectiveness and risk management of our technology systems and operations. Our CIO has over 30 years of experience in technology, cybersecurity and risk management, including leading information and technology initiatives for companies in the mining and energy sectors as a partner and senior managing director at a global professional services public company specializing in information technology services and management consulting. Our CISO is responsible for protecting our global technology systems from cybersecurity incidents, which includes overseeing the deployment of cybersecurity controls, managing a team of cybersecurity professionals and reporting on cybersecurity matters to management and the Audit Committee of our Board. Our CISO has 30 years of experience in the technology and cybersecurity industries, including 15 years serving as CISO for public companies. Our CISO is also a Certified Information Systems Security Professional.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: Our Cybersecurity and Privacy Programs include: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: To manage risks associated with third-party service providers, we typically require new vendors with access to our computing environment or access to confidential or sensitive data to undergo a risk assessment from our information security team. We conduct periodic reviews of these vendors to evaluate compliance with our cybersecurity policies. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of material cybersecurity in cidents, by virtue of the documents governing their relationship with us or applicable law.

companyName: FLUOR CORP

ticker: FLR


text: Southwest's incident response plan is designed to coordinate the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents. These activities include processes to triage, assess severity, communicate, contain, investigate, and remediate the incident, as well as comply with any applicable legal obligations and mitigate reputational damage.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Risk Assessment - Our enterprise risk assessment is performed by executives, management, and functional and department-level subject matter experts. This group engages in the ongoing monitoring of identified risks to the Company and risk mitigation efforts. Our enterprise risk management process captures the potential impact and likelihood of cybersecurity risk events by evaluating our current cybersecurity risk environment and our existing cybersecurity controls. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The SVP of IT & SCM, senior leadership, and our internal audit function provide both the full Board and the Risk Management Committee with periodic updates on the performance of our cybersecurity program.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Intrusion on our systems could damage our business" in Item 1A "Risk Factors" of this Form 10-K.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for two years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for two years, serving as CCO since May 2023 and has worked in the financial services industry for more than 27 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt and appropriate internal reporting of certain cybersecurity incidents, either in the form of a single unauthorized occurrence or a series of unauthorized occurrences, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Part I. Item 1A, Risk Factors — Operational, Strategic and Business Risks.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: As mentioned above, our SIEM tool monitors threat detection and response continuously. Identified threats create alerts which are monitored and addressed by our information technology team in accordance with internal policies, industry standard practices, and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed frequently and are supplemented on an ad-hoc basis for specific threats or to test patch status.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Company relies heavily on its information systems, and the availability and integrity of these systems is essential to conducting its business and operations. As a developer of modern energy economy technology systems and services, the Company faces various security threats, including cybersecurity threats, to gain unauthorized access to its sensitive information or to render its information or systems unusable, and threats to the security of its facilities and infrastructure or third-party facilities and infrastructure, such as gathering and processing and other facilities, and pipelines. This risk may be heightened as a result of an increased remote working environment, similar to the one created by the COVID-19 outbreak in 2020. The potential for such security threats subjects its operations to increased risks that could have a material adverse effect on its business, financial condition, results of operations and cash flows.

companyName: ConnectM Technology Solutions, Inc.

ticker: CNTM


text: Although we have designed its cybersecurity program and governance procedures noted above to mitigate cybersecurity risks, we continue to face unknown cybersecurity risks, threats and attacks. To date, these risks, threats and attacks have not had a material impact on our operations, business strategy or financial results; however, they may have a material impact in the future.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: The Company's cybersecurity environment is also subject to routine vulnerability assessment processes. Internal and external teams, including the Cyber Committee, conduct activities such as penetration testing, red teaming, tabletop exercises and phishing drills. Results are measured and assessed for possible improvements. In addition to these ongoing efforts, the Company has a set of third-party risk management tools through which it monitors for cybersecurity risks and threats associated with its third-party service providers. The Incident Response Plan includes processes that define how the Company manages and responds to such risks or threats associated with its third-party service providers.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Enterprise Risk Management Our policies and procedures related to Cybersecurity are a vital component of the Company's enterprise risk management program ("ERM") which is managed by the Company's Chief Risk Officer ("CRO") and is overseen by Audit Committee. Our ERM program includes periodic activities to assess cybersecurity risks that could result in material disruption to the Company such as data breaches, malfunction of critical systems to operate key banking functions, "information hostage" incidents, and interference with key vendor programs. Any cybersecurity risks identified are tracked through the ERM program and their assessments are assigned risk owners at the senior leadership level.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization ("ISO") and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder and Hinge, obtaining certification for their Information Security Management System (ISMS) under the ISO/IEC 27001:2022 standard.

companyName: Match Group, Inc.

ticker: MTCH


text: As cybersecurity risks continue to evolve and potentially affect businesses globally, Carpenter Technology understands that protecting business, employee, and customer information, data, and systems is of critical importance. Through a series of cybersecurity imperatives aligned with the National Institute of Standards and Technology (NIST), Carpenter Technology assesses, identifies and manages potential cyber risks. Imperatives include: • Increasing Visibility: Improve understanding of what to protect • Rapid Response: Mitigate the amount of damage that could occur • Shrink Surface of Attack: Reduce the total resources exposed to cyber threat • Identity Management: Ensure the right people have correct access • Supply Chain Risk Management: Manage security risks introduced by vendors and third parties • Data-Centric Security: Protect data throughout the lifecycle Carpenter Technology's multi-faceted cybersecurity program includes implementation of leading technologies to detect evolving cyber threats, recurring regular cybersecurity training to keep employees situationally aware, mock security exercises to prepare for rapid response, penetration tests to continuously improve operations, and internal audits to confirm controls are operating effectively. Carpenter Technology also maintains strong partnerships with law enforcement, leading academic institutions and peers in the manufacturing industry to stay informed of the latest cybersecurity developments and trends in the ever-evolving threat landscape. Employees annually review and acknowledge an information systems Acceptable Use Policy. Information Technology associates participate in comprehensive annual training including DFARS and Sarbanes-Oxley compliance training.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: We previously engaged an outside consultant to conduct a comprehensive cybersecurity assessment, the methodology for which was based on information security frameworks and guidelines such as the National Institute of Standards and Technology (NIST), Center for Information Security (CIS), and ISO 27001. Management reviewed the results of the assessment with the Audit Committee and worked with consultants, auditors, and other third parties to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We have in place a third-party risk management program to evaluate the cyber postures of our critical partners' who handle the Company's sensitive data in order to identify, monitor and address material cybersecurity risks that may arise from such third-party relationships.

companyName: ANALOG DEVICES INC

ticker: ADI


text: The CDIO and CISO provide reports to the Audit Committee at least semi-annually on the Company's cybersecurity program including the external threat environment, the Company's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and the results of evaluation of the Company's cybersecurity program by external experts. The Audit Committee, as well as the Board of Directors, is also promptly informed about any information security incidents that may pose significant risk to the Company.

companyName: Garrett Motion Inc.

ticker: GTX


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The technical personnel comprising our internal security committee are experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.

companyName: Zscaler, Inc.

ticker: ZS


text: We also provide new hire and annual security awareness and privacy training to employees. We conduct monthly phishing assessment exercises to ensure employees are aware and educated about phishing threats and are trained to identify and report them.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our IT cybersecurity team is led by our Head of Information Security, Sean Pike. Mr. Pike has over 25 years of experience leading and scaling cybersecurity practices across regulated industry and critical infrastructure. Most recently, he served as CISO at Business Wire, where he was responsible for transforming the security and compliance organizations to meet the needs of a globally distributed SaaS newswire. Prior to Business Wire, Mr. Pike held leadership positions at VMware, IDC, and Nielsen Radio. His work at the Company includes aligning cybersecurity, product security, and security compliance initiatives to business goals. Mr. Pike holds a JD in law from Syracuse University and a M.S. in telecommunications and network management from Syracuse University.

companyName: A10 Networks, Inc.

ticker: ATEN


text: Cybersecurity oversight begins with the Information Technology & Information Security Committee ("IT/IS Committee") of the Wintrust Board of Directors. The Wintrust Chief Security Officer ("CSO") ") and Deputy Chief Information Security Officer ("Deputy CISO") oversee the cybersecurity program. The CSO has a dual reporting structure, reporting to both the IT/IS Committee and the Vice Chairman/Chief Operating Officer of Wintrust. The CSO and Deputy CISO, each with extensive industry experience, manage a team of skilled professionals with cybersecurity expertise. This team governs our cybersecurity program that follows seven pillars: strategy; prevention, detection, response, measurement, compliance, and training. Our cybersecurity program employs a wide range of technological, administrative, and physical security measures designed to address the confidentiality, integrity, and availability of the information and data of both Wintrust and our customers. We have established policies, processes and procedures to monitor, report and respond to suspected or actual security events. A critical function of the cybersecurity program is the Security Operations Center, which is constantly monitoring Wintrust systems to detect threats. If any credible threats are detected, the Security Operations Center notifies both the CSO and Deputy CISO, and the appropriate response plan is initiated. The CSO will advise executive management and other relevant stakeholders as necessary. We coordinate with our third parties and vendor partners through assessments and due diligence before sharing or allowing the hosting of data. We also work with our outside partners to investigate security events that may have impacted our confidential and other information, and to leverage lessons learned during those investigations. In addition, we contractually require our third-party service providers that possess or process any Wintrust or customer information to adhere to certain security requirements, controls and responsibilities based on the risk profile of the relationship.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Stephen G. Crawford, age 59, is Executive Vice President, Manufacturing and Chief Sustainability Officer, with executive responsibility for global manufacturing and engineering and the corporate sustainability strategy. Mr. Crawford joined Eastman in 1984 and held leadership positions of increasing responsibility in both the manufacturing and technology organizations. From 2007 until January 2014 he served as Vice President of Global R&D in the AM and AFP segments. He was appointed Senior Vice President and Chief Technology Officer effective January 2014, and Senior Vice President, Chief Technology and Sustainability Officer effective October 2019. Mr. Crawford was appointed to his current position effective October 2022.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The Company has an established Information Security Committee to manage the information security risk assessment framework. This framework includes a defined methodology and tolerable level of risk documented within the Information Security Management System ("ISMS") and relevant controls addressing business risks. The committee is informed of all security incidents and ensures appropriate remediation activities are implemented. The Company's ISMS are audited by both internal and external parties on a regular basis. Results of audits and material security incidents are presented to the Board of Directors on a quarterly basis.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 26 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.

companyName: S&P Global Inc.

ticker: SPGI


text: Management personnel most involved with assessing and managing the cybersecurity risks and program with our ISP include our Head of Resources Management, who is also a member of our Board of Directors, and our CCO. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and 15-plus years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats, and has collaborated closely with security vendors and partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs that include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems. Our Board of Directors regularly receives updates from third parties on various business risks, which include cybersecurity matters.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: CommScope's commitment to cybersecurity begins in the boardroom. The Audit Committee is responsible for oversight of cybersecurity and is actively engaged with our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) at least quarterly, in addition to ad-hoc discussions and our periodic cyber crisis management tabletop exercises. Our CIO and CISO also present on cybersecurity to our full Board at least annually. The commitment extends through our executive leadership team (ELT), who engage continually to review our cybersecurity strategy, planning and execution.

companyName: Vistance Networks, Inc.

ticker: VISN


text: The Corporation has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect the Corporation. There can be no assurance that this will continue to be the case. Notwithstanding the Corporation's investment in cybersecurity, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, results of operations or financial condition. For a discussion of cybersecurity risks affecting the Corporation's business, see "Item 1A. Risk Factors - STRATEGIC AND OPERATIONAL RISKS - The Corporation relies on information technology systems to manage numerous aspects of the business and a disruption or failure of these systems could adversely affect business, operating results, and financial condition." which is incorporated by reference into this Item 1C.

companyName: HNI CORP

ticker: HNI


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Executive Security Council periodically reports to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment, and programs in place to address and mitigate the risks associated with the evolving cybersecurity threat landscape. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to any cybersecurity incidents. Material cybersecurity events, if any, are escalated to our full board of directors on an ongoing basis as necessary.

companyName: Cottonwood Communities, Inc.


text: Managing cybersecurity risk is a key focus for the Board of Directors. The Company seeks to ensure effective governance in managing risks associated with cybersecurity threats, as more thoroughly described below.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our cybersecurity risk management program is coordinated by cross-functional teams, including risk management, legal and compliance, business resiliency management and information security. These teams develop, implement and maintain our compliance policies, programs and training, business resiliency, disaster recovery and information security frameworks, solutions and procedures. They also work closely with our business, internal audit, finance and IT staff to identify, assess and mitigate risks, including those associated with our use of third-party vendors and service providers, and to monitor and take steps designed to prevent security incidents in our technology environment.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. The Company evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: CHUY'S HOLDINGS, INC.


text: We assess the cybersecurity posture of third-party suppliers, vendors, and other partners through due diligence, including assessments at the initiation of the relationship and on an ongoing basis appropriate to the cyber risk. Training and Awareness: All Kestra team members, including senior management, receive mandatory cybersecurity training and periodic phishing simulations. Periodic risk assessment: We periodically re-assess the cybersecurity program for continuous improvement and to account for emerging risks.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are also continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Internal Audit Reports. Our internal audit function's reviews of our information security programs and controls are included in quarterly reports to the Audit Committee.

companyName: Zumiez Inc

ticker: ZUMZ


text: The security of our information technology systems and Company data is important to our operations and reputation. Accordingly, we are committed to identifying and managing cybersecurity risks. Our cybersecurity team performs periodic risk assessments and, on a quarterly basis, provides our Enterprise Risk Management Committee ("ERM") information related to the Company's cybersecurity, including statistics on attempted cyber-attacks, status of employee information security training awareness, and information on any security investigations. The cybersecurity team advises the ERM of significant global cyber events that occurred during the quarter and whether they impacted DIRTT. The cybersecurity team regularly discusses with the ERM the Company's cybersecurity posture and whether the Company should implement additional protections and controls to assist the Company in protecting, responding to, or mitigating potential future cyber-attacks.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The Board of Directors receives a report on cybersecurity annually, and the AFC receives reports on cybersecurity multiple times a year. For meetings where cybersecurity is not on the formal agenda, the AFC will receive a pre-read that includes cybersecurity updates or discussion topics. During these reviews, management discusses various topics, including information relating to IT/OT Security strategy, program management, cybersecurity risks and threats, and provides briefings on notable cybersecurity attacks, including those relating to third-party service providers, if known. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on an as needed basis to the AFC and Board of Directors.

companyName: CONOCOPHILLIPS

ticker: COP


text: Our operations rely on the secure processing, storage, and transmission of personal, confidential, and other information. Our business, including our ability to adequately price products and services, establish reserves, provide an effective and secure service to our customers and report our financial results in a timely and accurate manner, depends significantly on the integrity, availability, and timeliness of the data we maintain, as well as the data held by our third party service providers. We manage cybersecurity risk via expectations set by our information security and related policies, real-time monitoring of threats, and recovery where needed through incident response plans.

companyName: Employers Holdings, Inc.

ticker: EIG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior security breach, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition and results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a discussion of certain risks related to cybersecurity, refer to the risk factor titled " Cybersecurity incidents affecting our information technology systems could disrupt business operations or cause the release of highly sensitive confidential or personal information, resulting in adverse impacts to our reputation and operating results and potentially leading to litigation and/or governmental investigations, fines and other penalties " in Part I, Item 1A. Risk Factors herein.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: As discussed above, this member of management reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: KINETA, INC./DE


text: We have not experienced a material security breach in our systems, and, to our knowledge, there have not been any material compromises of our confidential information in our third-parties' systems, nor have we incurred any significant expenses or penalties to resolve or settle any security breach in the past three years. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors – Our Business Risks – Our ability to manage our business is highly dependent on IT systems and our website, systems, and data we maintain may be subject to intentional or inadvertent disruption, security incidents, or alleged violations of laws, regulations, or other obligations relating to data handling that could adversely impact our reputation and future sales," in this Annual Report on Form 10-K.

companyName: QuantumScape Corp

ticker: QS


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO who has more than 30 years' experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Incident Response Planning: The Company has developed a comprehensive incident response plan. This plan outlines specific protocols for identifying, containing and eradicating cybersecurity incidents and threats to minimize their impact on our operations and stakeholders. A dedicated internal incident response team is responsible for executing this plan. The plan is regularly tested and updated to address evolving threats and industry best practices. Additionally, the Company works with relevant authorities and third-party specialists, as needed, to enhance cybersecurity threat response capabilities. The Company also has a cybersecurity risk insurance policy.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: To oversee cybersecurity risk at the management level, we employ a Chief Data and Information Officer ("CDIO") and a Chief Information Security Officer ("CISO"). The CDIO is responsible for the global data landscape and IT systems across our business units, including information security. The CISO leads our Information Security team. The CISO and his team are responsible for administering our comprehensive, company-wide information security program, which includes strategy, regulatory intelligence, IT risk management, policy development, security engineering, cyber threat detection, response, and operations. Our information security program is based upon, informed by, and responsive to industry best practice frameworks such as HITRUST CSF and ISO 27001. Our program undergoes an internal annual review that is conducted by our CISO, as well as an annual third-party external review. Additionally, we leverage a diverse array of internal and external assessors, consultants, auditors, and other third parties to identify opportunities for improvements to our information security program through methods such as penetration testing, independent audits, and consulting on best practices to address emerging risks and challenges. These assessments encompass evaluations of both the design and operational effectiveness of our security measures. Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto. We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.

companyName: Cencora, Inc.

ticker: COR


text: Notwithstanding the Company's processes for assessing, identifying and managing risks from cybersecurity threats, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. During 2024 and 2023, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: AMREP CORP.

ticker: AXR


text: We established a cyber incident management team that consists of our Sponsor's CIO, CISO, CFO, CLO and our CEO, CFO, General Counsel and Head of Marketing that is responsible for determining if a cybersecurity incident is material to us and requires disclosure. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification.

companyName: JLL Income Property Trust, Inc.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Risk mitigation strategies and key performance indicators are defined, and tracked, as part of the quarterly internal reporting. The Information Security & Compliance team consists of subject matter experts in the field on Information Security, Risk Management, Compliance and Data Protection. The Information Security & Compliance team monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to the CISO. The CISO is part of the senior management team and regularly updates the Technology, Data and Supply Chain Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity. Our information security team assists in taking any remedial action in response to an incident, and external experts may also be engaged as appropriate.

companyName: Option Care Health, Inc.

ticker: OPCH


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than two decades of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional. He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.

companyName: KORN FERRY

ticker: KFY


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity consultants and software providers, managed cybersecurity service providers, penetrating testing firms, and forensic investigators.

companyName: Xometry, Inc.

ticker: XMTR


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could effect our information or systems. For more information, please see the section entitled "Risk Factors".

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Our Board of Directors (the "Board") employs a principles-based approach to identify and monitor the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.

companyName: Cable One, Inc.

ticker: CABO


text: Company is in the process of establishing a cybersecurity policy which implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS