text: The Company's IT department has developed and implemented cybersecurity policies and procedures designed to align with industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, and applicable regulatory requirements.

companyName: DallasNews Corp


text: We rely on the information technology and systems maintained by our manager, RMR, and rely on our manager to identify and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's Chief Information Officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: OFFICE PROPERTIES INCOME TRUST

ticker: OPITQ

secItem: Item 1C


text: We design and assess our program based on the CIS Critical Security Controls Version 8 ("CIS"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use CIS as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Viant Technology Inc.

ticker: DSP


text: Risks from cybersecurity threats or incidents (cybersecurity risks) are assessed, identified and managed by the Company in a manner that is consistent with leading cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST Framework). The Company's approach to cybersecurity risk management is generally based on the six core functions contained within the NIST Framework organizing structure: identify, protect, detect, respond, recover and govern.

companyName: RLI CORP

ticker: RLI


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We and our subsidiaries currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. Our IT staff along with the third-party providers and outsourced IT services monitor and address cybersecurity related risks, including installing software for threat protection and malware. Our IT staff and such third-party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate.

companyName: TECHPRECISION CORP

ticker: TPCS


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our Board of Directors (the "Board") addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.

companyName: Origin Materials, Inc.

ticker: ORGN


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company and Advisers, in connection with their day-to-day operations. TIAA's cybersecurity leadership team are responsible for maintaining and overseeing the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting TIAA and its affiliates, including the Company, the Advisers and their respective third-party service providers.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of experience in information technology including IT leadership in Department of Defense Research. Our VP of IT who reports to our Chief Financial Officer, or CFO, who has 23 years of experience as a CFO, including supervisory responsibility over IT and cybersecurity functions.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: our Chief Privacy Officer; and our crisis management team, a cross-functional team of senior management and subject matter experts from across the Company established to be ready to respond to crisis events, including those arising from cybersecurity incidents.

companyName: EASTMAN KODAK CO

ticker: KODK


text: External Assessments. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants. Cybersecurity processes are adjusted based on the information provided from these assessments. In addition to annual attack and vulnerability testing, we engage a third-party cybersecurity provider for managed detection and response and as a managed security operation center.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: The CISO, who reports to our CIO, is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO manages a team of professionals with broad cybersecurity experience and expertise. Our CISO has served in various roles in information technology and information security for over 20 years and holds an undergraduate degree in Information Systems from Xavier University and an MBA from Michigan State. The CISO and his regional security leaders have a combined total of over 25 Information Technology and Cybersecurity certifications, including Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Security Manager.

companyName: APi Group Corp

ticker: APG


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation.

companyName: Encompass Health Corp

ticker: EHC


text: We use third-party service providers to perform a variety of functions throughout our business, such as application service providers, software-as-a-service providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources. We have a vendor management process to help manage cybersecurity risks associated with our use of these providers. This includes risk assessment for each vendor, review of security assessments, supplemental security questionnaires (as needed), security assessment calls with the vendor's security personnel, and imposition of certain information contractual obligations on the vendor. In addition, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, vulnerability scans related to the vendor, and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. CIDARA THERAPEUTICS, INC.

companyName: Cidara Therapeutics, Inc.


text: Management is responsible for assessing and managing our day-to-day risks and control systems, and our Board is responsible for overseeing our enterprise risk management programs as a whole. The Board has delegated the oversight of cybersecurity risk assessment and management to the audit committee. As reflected in its charter, the audit committee is responsible for overseeing and reviewing the Company's cybersecurity and information security programs, practices and risk mitigation efforts. The audit committee receives quarterly reports on cybersecurity risks, or more frequent reports if circumstances dictate.

companyName: ANALOG DEVICES INC

ticker: ADI


text: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Each quarter, our Chief Information Security Officer ("CISO") presents an overview of the Company's cybersecurity risk landscape to our Enterprise Risk Management Committee, which includes our Executive Leadership Team and Vice President, Internal Audit. In addition, our CISO Council, which includes our CISO and our Chief Information and Digital Officer, holds meetings with our Executive Leadership Team on a quarterly basis to review these cybersecurity risks and mitigation measures in further detail.

companyName: ENTEGRIS INC

ticker: ENTG


text: Board Oversight of Cybersecurity Risks Our Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Compliance Officer regarding the overall state of the cybersecurity programs of our Adviser, custodian, transfer agent and Administrator, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Muzinich BDC, Inc.


text: In addition, we engage third-party assessors, consultants and other third parties from time to time to assist us with assessing, enhancing, implementing, and monitoring our cyber security risk-management programs. We review the results of the assessments and reviews of these third-parties and determined whether to adjust our cybersecurity policies and processes based on their recommendations.

companyName: MATERION Corp

ticker: MTRN


text: Company has adopted a cybersecurity policy (the "Cybersecurity Policy") governing the establishment and application of certain procedures and safeguards to identify potential cybersecurity risks and, in the event of a cybersecurity breach, the protocol for disclosing to the Securities and Exchange Commission, including possible remedies. The members of the Board of Directors reviews cybersecurity risk as part of our overall risk-management program. This ensures that cybersecurity risk management remains a meaningful priority in our business strategy and operations. Our risk management strategy for cybersecurity generally includes:

companyName: Kun Peng International Ltd.

ticker: KPEA


text: To date, Northern Trust has not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. For more information about these risks, see "Breaches of our security measures, including, but not limited to, those resulting from cyber-attacks or other information security incidents, may result in losses," in Item 1A, "Risk Factors."

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: The Board of Directors oversees Management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents at quarterly Board of Directors meetings.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: At the management level for Southwest, our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by Southwest's President and the Vice President/Information Services/Chief Information Officer, along with the Director of Information Security, Manager of Cybersecurity Services, and Manager of Information Security Compliance and Administration. A Cybersecurity Executive Committee, consisting of officer-level management appointees representing key areas of our business, exists to maintain situational awareness of cybersecurity risks, support methods of addressing cybersecurity risks, and support the Chief Information Officer's efforts to help Southwest follow natural gas sector-specific regulations and reporting. The Cybersecurity Executive Committee meets regularly with legal advisors and cybersecurity professionals. In our Information Services Department, the cybersecurity management team members hold degrees in information technology or cybersecurity and industry-recognized certifications in cybersecurity, and each has many years of relevant work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Cybersecurity team members are expected to keep their knowledge, skills, and training current by participating in industry events and continuing education programs as applicable.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Third-party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports (or international equivalent) of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. Annually, they also present information regarding management's annual cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This annual briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. The Audit Committee is notified and briefed regularly in the event of a cybersecurity incident, regardless of the ultimate severity of the situation. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: NEE, including FPL, operates a cybersecurity operations center and has cyber threat intelligence capability to identify, monitor, detect and respond to cybersecurity threats which is led by a cybersecurity incident response team. NEE, including FPL, uses these resources, and leverages third-party resources, to identify cybersecurity threats and monitor for anomalies that may result in cybersecurity incidents on its systems, and monitors for impacts to its vendors or suppliers. Assessment of incidents includes, but is not limited to, analysis of the urgency and operational or business impact of an incident and the status and effectiveness of incident defenses. NEE, including FPL, invests in personnel and technologies with the objective of limiting the frequency and impact of cybersecurity incidents. Following documented cybersecurity incident response procedures, the cybersecurity incident response team escalates information about cybersecurity incidents depending on circumstances to oversight committees and personnel charged with managing specific aspects of cybersecurity risk, including, among others, the Cybersecurity and Resiliency Committee, the Cybersecurity Governance Executive Committee and NEE's Board of Directors.

companyName: FLORIDA POWER & LIGHT CO


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances. Our information technology department works with management, including the Chief Operating Officer and Chief Financial Officer, to help mitigate and remediate cybersecurity incidents of which they are notified. Our information technology department, led by our director of information technology, includes individuals with over 20 years of prior work experience in various roles involving security, compliance, systems and risk management implementation. In addition, our incident response processes include procedures for reporting material cybersecurity incidents to the Audit Committee for material cybersecurity incidents.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. bioAffinity acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. For more information on cybersecurity risks see Item 1A. "Risk Factors – Our internal information technology systems, or those of our third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our diagnostic tests' or therapeutic product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: bioAffinity Technologies, Inc.

ticker: BIAF


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Our Audit Committee is informed of such risks through reports from our Chief Information Officer ("CIO") on at least an annual basis.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Security Risk Assessment ("SRA") to identify the potential impact and determine the controls. We this SRA our cybersecurity roadmap and strategies to ensure the best IT security environment is implemented at our company. We use various tools cybersecurity risk—including, not the the use Managed Endpoint Detection and Response ("EDR") software and for our Local Area Network (LAN) monitoring with internal and external Security Operations Center

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: Our Senior Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help us prepare our employees to address cybersecurity risks. Our Senior Director of Information Technology has over seventeen years of experience in information technology, eleven years of experience in information technology for life sciences companies, and a relevant bachelor's degree in information technology. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Solid Biosciences Inc.

ticker: SLDB


text: For additional information concerning risks related to cybersecurity, see Item 1A. Risk Factors: Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation.

companyName: CapForce Inc.

ticker: OPGN


text: The CISO is responsible for the ISMS and reports directly to the CIO. The CIO is the head of the company's global IT team which has an integrated governance structure consisting of a Senior Executive Committee, a Cyber Executive Committee and Cyber Leaders. The Senior Executive Committee meets quarterly, prioritizes the information technology components of strategic business imperatives and oversees IT capability and security programs. The Cyber Executive Committee meets monthly, reviews identified risks, sponsors initiatives to address risk, and oversees security and compliance responses. Cyber Leaders are management representatives from all functions and lines of business who are responsible for executing programs and initiatives sponsored by the Senior Executive Committee.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: The Audit Committee oversees cybersecurity risk management through the periodic reports it receives from management. On a quarterly basis, management reports on any significant cybersecurity events and trends impacting the Company. Annually, our CIO and CISO report to the Audit Committee on our information security program, including with respect to team updates, key areas of risk and the effectiveness of the program. The Audit Committee also reviews the Company's cybersecurity insurance program on an annual basis in connection with the program's renewal and receives periodic reports from our Director of Internal Audit regarding internal audits of our information security program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, and for various other aspects of the business.

companyName: AmBase Corp

ticker: ABCP


text: Management is informed about the monitoring activities performed by the Information/Cybersecurity team for the detection, prevention, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with enterprise risk management, legal, information technology, and/or compliance personnel of the Adviser and Lord Abbett.

companyName: Lord Abbett Private Credit Fund


text: The Company's Information Security Awareness Program, a component of the Security Program, is designed to ensure that all employees are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.

companyName: M&T BANK CORP

ticker: MTB


text: We rely on the information technology and systems maintained by our manager, Tremont, and RMR, and rely on Tremont and RMR to identify and manage material risks from cybersecurity threats. RMR takes various actions, and incurs significant costs, to maintain and protect the operation and security of information technology and systems, including the data maintained in those systems. Our Audit Committee oversees cybersecurity matters, including the material risks related thereto, and regularly receives updates from RMR's Chief Information Officer regarding the development and advancement of its cybersecurity strategy, as well as the related risks. In the event of a cybersecurity incident, RMR has a detailed incident response plan in place for contacting authorities and informing key stakeholders, including our management. We have not been materially affected and do not believe we are reasonably likely to be materially affected by any risks from cybersecurity threats, including as a result of previous incidents.

companyName: Seven Hills Realty Trust

ticker: SEVN


text: The Company's Chief Executive Officer, an engineering expert with over eight years of experience in leading our company, is responsible for developing and implementing our information security measures and overseeing our IT department. The Company has established a physical firewall, with physical gateways that filter suspicious files and data flows entering and exiting our Company's network. In addition, the computers in our R&D department are equipped with behavior control software, which makes emails and files sent from the R&D computers in an encrypted state and inaccessible without specific authorization from designated supervisors.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Ali Matera, Chief Digital Officer – Ms. Matera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: Bridge Investment Group Holdings Inc.


text: We maintain a security organization that is responsible for overseeing security practices across the Company, including with respect to information, personnel, and facilities. Our information security team maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity and other information security threats, including as may be related to our third party vendors and suppliers.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company's systems and information.

companyName: Microbot Medical Inc.

ticker: MBOT


text: We have not identified any risks from cybersecurity incidents or threats that have materially affected our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in "Item 1A Risk Factors" of this Annual Report.

companyName: Enact Holdings, Inc.

ticker: ACT


text: As part of the escalation procedures stated in our Cybersecurity Incident Response Plan, if we become aware that a cybersecurity incident has occurred, our information technology professionals shall notify the CEO and CFO immediately upon recognition of the breach or event, to help ensure high-level involvement and decision-making. The CEO and CFO shall assess the overall impact of the event and its potential impact on the Company's business operations. If deemed significant, the Audit Committee and full Board of Directors shall be informed of the incident.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Our IT function, which is led by the CIO, maintains and is initially responsible for executing on a cybersecurity incident response plan and specific runbooks, which describe processes for evaluating and escalating, depending on severity, within the enterprise and up to our senior executive management and board of directors the cybersecurity threats and incidents, or potential threats or incidents, identified through our cybersecurity measures, as well as making public disclosures thereof. This team also maintains other policies and procedures concerning cybersecurity matters, such as encryption standards, antivirus protection, remote access, multifactor authentication, data classification, confidential information and the use of the internet, social media, email and wireless devices. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio.

companyName: KB HOME

ticker: KBH


text: S&TO engages third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our IT security controls and provide certifications for industry-standard security frameworks. In addition, we maintain a global privacy program to assess and manage privacy risks related to how we are collecting, using, sharing, and storing personal data, which is subject to assessment by an independent, third-party privacy assessor.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: W e do not maintain any information systems that would be subject to a cybersecurity threat. Our credit card processing is outsourced to a third party that uses a double authentication protocol.

companyName: INNOVATIVE DESIGNS INC

ticker: IVDN


text: We have controls in place intended to assess our cybersecurity posture and prevent successful access to our critical systems, including, but not limited to: vulnerability scanning on systems and applications; endpoint detection capabilities to identify malware and other indicators of threat activity; multifactor authentication; and blocking of malicious e-mail. In addition, we also provide annual cybersecurity awareness training for our employees. Further, we engage with an external security firm to perform regular penetration testing. We subject our critical third-party service providers to risk assessment prior to engagement, and periodically thereafter, to identify material risks. Additionally, we have a process to engage with these third parties to understand potential impacts of, and remediation efforts associated with, critical vulnerabilities.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: We have established policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk & Compliance Committee.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We also maintain cyber liability insurance coverage. While we currently hold such coverage, we cannot be certain that our insurance coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any future claim will not be excluded or otherwise be denied coverage by any insurer.

companyName: Arista Networks, Inc.

ticker: ANET


text: We maintain an information security program and governance framework that are designed to protect our information systems against operational risks related to cybersecurity.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Cybersecurity Risk, Management and Strategy We acknowledge the critical nature of evaluating, pinpointing, and addressing the significant risks posed by cybersecurity threats. Our organization has established a comprehensive set of processes, technologies, and mechanisms to support the identification, evaluation, and management of these risks. Central to our cybersecurity strategy is the mitigation of threats, ensuring the robustness and reliability of our system infrastructures. We utilize the guidelines provided by the National Institute of Standards and Technology (NIST) Cybersecurity Framework to shape our cybersecurity initiatives and comply with the Payment Card Industry Data Security Standards where necessary.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: Duke Energy's second line of defense against cybersecurity threats is the EST, which is led by the CSISO, and actively evaluates, anticipates and tests Duke Energy's cybersecurity risk level and preventive and risk mitigation controls relative to the enterprisewide risk level and controls. The EST is responsible for infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments, employee awareness and training programs and security incident management, including oversight of the remediation of cybersecurity incidents. The EST monitors cyber activity and also reports on the status of the Company's cybersecurity performance and any ongoing remediation efforts to the Company's Chief Information Officer (CIO) and CSISO. The CIO and CSISO report these cybersecurity metrics, which use a vulnerability management scoring system and closely align with the National Institute of Standards and Technology Cybersecurity Framework, to the Audit Committee at each regularly scheduled Audit Committee meeting. The EST also employs tools and oversees and challenges Duke Energy's cybersecurity and technology metrics under its Enterprise Security Risk Register to track, identify and manage risk. To this end, the EST engages outside expert firms to perform a comprehensive external penetration test each year, performs system and application penetration testing several times throughout the year, and conducts annual exercises simulating the tactics, techniques, and procedures of advanced threat actor groups to test the Company's ability to prevent penetration, detect suspicious activity and respond to these threats in a timely manner. Lessons learned inform the ongoing improvement of security preventive and mitigating controls and procedures and the results of such testing and threat actor simulations are shared with senior management and the Board of Directors. Duke Energy also has a senior management committee, the Executive Cybersecurity Oversight Governance Committee (ECOG), which governs enterprise-level cybersecurity risk tolerance.

companyName: PROGRESS ENERGY INC


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In past years, our Information Security Management System has continued to work a Plan of Action and Milestones ("POAM") tied to the United States Cybersecurity Maturity Model Certification ("CMMC") program, formerly the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, while looking for synergies across other standards, such as the Information Assurance Technical Framework ("IATF"), or as required for specific product lines or customers. Furthermore, we benchmark externally against other industrial manufacturers within the B2B (Business to Business) manufacturing industry, and even to a vertical level to determine Chart's risk profile through cybersecurity insurance tools that rank companies and bring them together within forums for cyber intelligence sharing and best practices.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Except as described above, to date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: Ubiquiti Inc.

ticker: UI


text: We are subject to various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; virtual and cyber threats to our directors, officers, and employees; and threats to the security of our infrastructure and assets. To mitigate the threats to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors, and have integrated these processes into our overall risk management systems and processes. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make investments as may be required to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in people and technologies has contributed to a culture of continuous improvement that has put the Company in a position to protect against potential compromises.

companyName: BTCS Inc.

ticker: BTCS


text: The risks from cybersecurity threats have not materially affected the Company's business strategy, results of operations, or financial condition. Although the Company has invested substantial resources to manage and reduce cybersecurity risk, it is not possible to eliminate this risk. The Company obtains insurance that protects against certain losses, expenses, and damages associated with cybersecurity risk. See Item 1A, "Risk Factors," for additional information regarding cybersecurity risk.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us, but we do ensure all proper cybersecurity protocol and due diligence is applied across the organization. While Patrick maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Our cybersecurity governance and strategy program to prevent, detect, manage, mitigate, and remediate cyber threats is comprised of: • Controls based upon the NIST Cybersecurity Framework for enterprise governance, critical asset management, internal and third-party risk management, segregated access control management, data security and protection, anomaly logging and general security monitoring, incident response, security training and awareness, and disaster recovery testing. • Security Policies and Procedures for cybersecurity, incident response, acceptable use, change control, disaster recovery, backup and recovery, business continuity, business operations recovery, third-party vendor security assessments, vulnerability and patch management, data privacy, and various regulatory compliance areas. • Enterprise Risk Management to identify, assess and mitigate internal and third-party risks in a continuous life cycle program which is also based on the NIST Cybersecurity Framework. This risk management framework incorporates corporate and business segment SCADA (Supervisory Control and Data Acquisition) system risks for an integrated enterprise approach. • Various Cybersecurity Systems and Protocols for aggregated monitoring, detection and response, network protection and segmentation, layered security methods, vulnerability and patch management, backup and recovery, and asset management. • Employee Education for continual security awareness and threat diligence. The program includes a myriad of monthly and quarterly required cyber training for high-risk areas plus mandatory semi-annual training for all employees and third parties with access to our network. Additionally, monthly simulated phishing campaigns and newsletters reinforce cyber risks and general security awareness.

companyName: NGL Energy Partners LP

ticker: NGL


text: Our information security team, led by our Chief Information Officer, is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. The information security team is managed on a day-to-day basis by our Director and Executive Director of Information Security and works cross-functionally throughout the organization to assess and prepare the Company for identification and mitigation of, and if necessary response to, information security risks. Our information security team members collectively have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).

companyName: Alkermes plc.

ticker: ALKS


text: Our personnel undergo mandatory periodic training on cybersecurity threats, with updated insights into effective defense mechanisms and our evolving cybersecurity policies and practices. of Third Parties: We collaborate with external cybersecurity service providers, including auditors and consultants, to refine our cybersecurity measures.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: We have developed and implemented a cybersecurity risk management policy intended to protect the confidentiality, integrity and availability of our critical systems and information. Our policy establishes the framework for managing cybersecurity risks and outlines the measures and protocols to protect our information systems. Our risk management and strategy is managed by our third-party IT Management Service Provider, Network Center, Inc. ("Network Center") with oversight by our VP of Operations. Our policy applies to all employees, contractors, and all third-party partners who have access to our information systems. Our cybersecurity risk management policy is integrated into our overall enterprise risk management processes.

companyName: Lodging Fund REIT III, Inc.


text: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management. Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the ISC and the Enterprise Risk Committee ("ERC"). The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer ("CIO"). Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is MCSE certified. Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice. Other members of the ISC have work experience related to information security issues and/or hold industry certificates, including Certified Information Systems Security Professional (CISSP). The ERC is a standing committee providing oversight on overall enterprise risk. The ERC is chaired by our Chief Legal Counsel and is composed of representatives from senior management. The Board of Directors receives regular updates and reports from members of senior management regarding our cybersecurity risks and protection measures, including any notable cybersecurity incidents, and evaluates risks posed by cybersecurity threats.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: We engage a variety of third-party service providers to process and store data, including certain customer information, some of which may include personally identifiable information. We also depend on third-party service providers to host many of the systems and infrastructure used to provide our products and services. A limited number of third-party services support essential functions of our business, including the use of cloud-based technology. We have a third-party service provider management program to manage cybersecurity risks associated with our use of these third-party service providers. The program includes the use of security questionnaires, review of statements of work and related information security addenda, procuring results of audits and compliance reviews and obtaining overviews of network infrastructure, among others. Based upon the extent and type of services utilized, reviews of certain third-party engagements are coordinated through members of the following management teams: procurement, legal, compliance, enterprise risk management and information security risk management, among others, as applicable. Depending on the nature of the services provided, the sensitivity of the data at issue and the identity of the third-party, our third-party service provider management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Risk Assessment: The Company generally evaluates risks, including cybersecurity risks, based on probability, impact and proximity. As part of its program, the Company conducts formal cybersecurity risk assessment exercises on an annual basis. The Company has documented processes and protocols in order to delineate unacceptable levels of risk and assess such risks based on a number of factors.

companyName: Vertiv Holdings Co

ticker: VRT


text: use of third-party services to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to our systems;

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Senior Management's Role in Managing Risk We have a leadership group consisting of certain members of our senior management team that is responsible for assessing and managing risk and implementing policies, procedures and strategies pertaining to security governance and data privacy, that is led and informed by our VP of Technology who develops and oversees the programs, policies and controls we have implemented across the organization to reduce and prevent logical and physical risks, including information security and cyber risks to our people, intellectual property, data and tangible property. Our VP of Technology has over 20 years of relevant experience in roles such systems controls, audit, governance, software development/design, systems implementation, IT infrastructure operations, cybersecurity, and overall management of the technology function. Most of that experience has been in the energy and financial services sector. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring, and testing the Company's cybersecurity program.

companyName: Greenbacker Renewable Energy Co LLC


text: The Company's cybersecurity policies and procedures will be reviewed by the CISO and updated at least annually and will include an incident response plan ("IRP") for detecting, responding to and limiting the effects of a cyber security event. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. Cybersecurity policies and procedures will also be subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company will require employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: Ongoing Evaluation and Assessment of Systems and Processes: We continuously evaluate and enhance our systems and processes to adapt to evolving cybersecurity threats, ensuring the resilience and effectiveness of our security measures.

companyName: Whitestone REIT

ticker: WSR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats.

companyName: Dynamix Corp

ticker: ETHM


text: We operate in the biopharmaceutical sector, which is a highly regulated sector subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; disruption of our clinical trials, manufacturing or supply chain; violation of privacy laws and other litigation and legal risk; and reputational risk. We rely primarily on industry-leading third parties and a cloud-based infrastructure for our information technology systems, and accordingly are dependent on these third parties' own cybersecurity risk management practices and strategy. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial data, intellectual property, confidential information that is proprietary, strategic, financial or competitive in nature, and personal data ("Information Systems and Data").

companyName: GERON CORP

ticker: GERN


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have an enterprise incident management plan that provides a framework for preparing for, managing and responding to cybersecurity incidents that may arise.

companyName: US Alliance Corp


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees.

companyName: RYTHM, Inc.

ticker: RYM


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including oversight by our Board of Directors, executive commitment and employee training. Our Risk and Security Committee, comprised of independent directors from our Board, assists the Board in overseeing our cybersecurity and data privacy risk. Specifically, our Risk and Security Committee, which meets quarterly, (i) receives periodic reports from our Chief Security Officer ("CSO") on security programs, including incident reports, (ii) reviews cybersecurity risk assessments from information security, privacy, and internal audit management teams, including the adequacy and effectiveness of the Company's internal controls regarding cybersecurity; (iii) reviews emerging cybersecurity developments and threats; (iv) reviews compliance with applicable laws and industry standards; and (v) periodically reviews our strategy to mitigate cybersecurity risks, such as our cyber insurance coverage and contingency plans in the event of security incidents or other system disruptions. At least quarterly, our Risk and Security Committee provides reports to the full Board of Directors regarding matters recently discussed by the Committee, which enables the full Board to provide additional oversight of our cyber risks and cyber processes. The full Board also reviews our cybersecurity risks in connection with its annual review of our enterprise risk mitigation programs.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: For a discussion of cybersecurity risks or the impact of previous cybersecurity incidents and how they have materially affected us or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A. Risk Factors " Risks Related to Our Business", which are incorporated by reference into this Item 1C.

companyName: Westrock Coffee Co

ticker: WEST


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Oversight and Governance The Company's Board of Directors is charged with overseeing and approving Union's risk management framework and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. Union's Information Security Officer (ISO) provides periodic updates regarding cybersecurity risks and the cybersecurity program to the Board of Directors. Additionally, awareness and training on cybersecurity topics is provided to the Company's Board of Directors on a regular basis. Consistent with this responsibility the Board has delegated primary oversight responsibility over the risk management framework and oversight of the cybersecurity program, including oversight of cybersecurity risk and cybersecurity risk management, to Union's IT Steering Committee.

companyName: UNION BANKSHARES INC

ticker: UNB


text: the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes, which enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices; cybersecurity awareness training of employees with access to our IT systems;

companyName: SIMON PROPERTY GROUP L P


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown and changing cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy, or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: The Company has designed this Cybersecurity program based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"). Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's Cybersecurity and Information Technology programs are led by our Chief Operations Officer, ("COO") and Information Security Manger. The COO is responsible for the oversight and implementation of both programs. Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee ("IT Steering Committee") on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: The Board of Directors monitors cyber risk through quarterly reports from the Board's Risk and Compliance Committee. This Board committee meets quarterly and receives information concerning cyber risk activities, including cyber risk assessments and incident reporting. The Board also receives an annual report covering cyber risk from the Chief Information Technology Officer. Controls over cyber risk are reviewed throughout the year by internal audit activities and third-party assessments whose reports are reviewed by the Board's Audit Committee.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: ALEXANDERS INC

ticker: ALX


text: Our Board is responsible for overseeing our overall enterprise risk management program, and each of its committees assists in this risk oversight role. Our Board has delegated the monitoring and oversight of risks relating to data privacy, technology, information security, and cybersecurity to our Audit Committee, which regularly reports to our Board regarding its activities, including those related to the management of these risks. Our Board also receives periodic briefings from management regarding our cybersecurity risk management program, including presentations on cybersecurity topics from our CTO, our information security team, and other third-party experts.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Management is responsible for the cybersecurity risk management program as well as actions to identify, assess, mitigate, and remediate material issues. The Company's cybersecurity risk management program is supervised by our IT manager, who reports directly to the Company's Chief Executive Officer. The IT manager and his team are responsible for leading cybersecurity strategy, policy, standards, architecture and processes.

companyName: Future FinTech Group Inc.

ticker: FTFT


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our initial public offering.

companyName: Red Rock Acquisition Corp.


text: The Company relies on GC Advisors to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on GC Advisors' risk management program and processes, which include cyber risk assessments.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management and Board of Directors, mitigation, remediation, and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Simulations Plus, Inc.

ticker: SLP


text: We have not experienced any material cybersecurity incidents to date, and, by default, we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in cybersecurity and the resilience of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Secure Software Development Framework ("SSDF"). This does not imply that we meet any particular technical standards, specifications, or requirements; we use NIST CSF and SSDF as guides to help us identify, assess, and manage risks from cybersecurity threats relevant to our business.

companyName: Atlassian Corp

ticker: TEAM


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: WEWARDS, INC.

ticker: WEWA


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program generally follows processes outlined in frameworks such as the International Organization for Standardization's ("ISO") international standard for Information Security ("ISO 27001") and the National Institute of Standards and Technology's Cybersecurity Framework 2.0 ("NCSF") and we evaluate and evolve our security measures as appropriate. As of December 31, 2024, we have not completed all of the requirements to be ISO 27001 or NCSF certified. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: Our CISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, monitoring and incident response, vulnerability assessment, third-party risk management, change management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function. The second line of defense function is separated from the first line of defense function through organizational structure and overall cybersecurity management is independently reviewed by a third line through the audit function. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Management maintains a structured and systematic approach to reporting cybersecurity information to our Board. The audit and risk management committee (the "audit committee") of our Board has primary oversight over our cybersecurity program. The audit committee is comprised of independent directors with expertise in risk management, technology, finance, and cybersecurity. In addition, audit committee members also have experience with cybersecurity oversight from their membership on other public company boards.

companyName: Snap One Holdings Corp.


text: The Audit Committee reviews our cybersecurity management strategy and initiatives on a regular basis and oversees the management of risks from cybersecurity threats, including the policies, processes, and practices implemented by the Company to address such risks. The Audit Committee also routinely receives reports on the cybersecurity landscape, regulatory requirements, industry standards, and emerging threats. Prompt and timely information regarding any significant cybersecurity incident as specified in our IRP, including ongoing updates as the incident unfolds and until it has been addressed, are also provided to both the Board and the Audit Committee.

companyName: VAIL RESORTS INC

ticker: MTN


text: –Information Technology Department: The information technology department consists of employees with extensive cybersecurity experience, including the Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, as well as a team of compliance and security associates. Cybersecurity experience within the information technology department includes prior work experience and bachelor's degrees or higher in technology related fields. In addition to internal resources, we engage a cyber insurance carrier with comprehensive data privacy and security risk management services; a managed security service provider with comprehensive security solutions, including continuous network monitoring, reporting and assistance with investigation; and an information security consulting company that consists of cybersecurity experts and information security practitioners to provide additional cybersecurity support. We also maintain a system of information technology controls and procedures, including controls and procedures related to authentication and access, recovery plans and secured backups of data, the design of applications and selection of packaged software, and testing of significant changes in applications and infrastructure technology. We also provide training to our employees about cybersecurity, perform penetration testing at least annually, perform security incident preparedness activities at least annually, and perform an annual Payment Card Industry ("PCI") attestation. Third party providers involving information technology are identified as part of our contract review process. System and Organizational Controls ("SOC") reports are reviewed annually for third party providers. The information technology department continuously monitors for cybersecurity threats in order to detect if a cybersecurity incident has occurred. The department uses endpoint detection and response ("EDR") and security information and event management ("SIEM") with the assistance of our managed security service provider and internal analysts to detect and identify threats. Lastly, we follow the National Institute of Standards and Technology ("NIST") Framework, which enables us to compare ourselves against the industry and manage dynamic cybersecurity risks.

companyName: CEDAR FAIR L P


text: Our board of directors has delegated oversight of our cybersecurity program to our audit committee. Our audit committee, which consists of solely independent directors, reviews our enterprise risk and cybersecurity risks on a regular basis. It also reviews steps management has taken to protect against threats to our information systems and security and receives updates on cybersecurity from our information technology team on a periodic basis. The full board of directors also periodically reviews our cybersecurity risks with management and the actions we are taking to mitigate such risks. The CAO or their designee reports to the audit committee on a periodic basis on the status of our cybersecurity program. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: The Company has an enterprise risk management committee comprised of key business and functional leaders to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discusses with the Board changes in assessment of these risks and mitigation plans.

companyName: LA-Z-BOY INC

ticker: LZB


text: The Company employs an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing throughout the year to measure the effectiveness of our information security program. The Company engages external third parties to advise on emerging threats to stay current and strengthen our security capabilities. The Company performs penetration testing and other exercises within internal and external networks for potential vulnerabilities.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: While we have experienced cybersecurity incidents that resulted in the disruption of our information technology systems and required us to engage third parties to remediate the issues, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our business, results of operations and financial condition. See Item 1A, "Risk Factors - We rely extensively on information technology systems, and cybersecurity incidents could adversely affect us."

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Additionally, the Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information security program, including to conduct risk assessments, vulnerability scans, and penetration testing based on nationally accepted standards. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as requiring an independent assessment of the third party's information security controls where appropriate. As part of the Company's process to continuously improve its information security programs, the Company also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of the Company's information security program.

companyName: Uniti Group LLC


text: In the event of a suspected or actual cybersecurity incident, the Security Incident Response Team (SIRT), which includes the CISO, has primary responsibility for initial identification and evaluation of potential business impacts and escalation of the incident's severity classification using pre-established criteria with a specified communication matrix and escalation thresholds. The Security Incident Commander, which role is served by rotating leaders in the CISO organization, provides tactical leadership and oversight management at the cross-functional level for the incident. The SIRT remains engaged throughout the incident response lifecycle, including detection and analysis, containment, eradication and recovery, and post-incident remediation, and coordinates with the impacted business functions, if warranted. Once a cyber incident is confirmed, the SIRT is responsible for maintaining situational awareness and continuous monitoring of the need for escalation or de-escalation of the incident's severity classification. As certain escalation thresholds are exceeded, additional levels of management notification are required by the SIRT, including notification of and recurring communication with Entergy's Incident Response Team, which includes the Chief Executive Officer, the Chief Operating Officer, the CSO, other executive management, and members of the affected business functions. Depending upon the facts, analysis, materiality, and anticipated or current impacts, the Chief Executive Officer and the General Counsel will determine the timing and cadence for communication of the cyber incident with the Board of Directors or Audit Committee.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the knowledge of information technology, legal and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Stone Point Credit Corp


text: Third-Party Monitoring. We partner with a managed security services provider for 24/7 monitoring of our enterprise network. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity measures aligned with applicable legal standards and industry best practices.

companyName: Ingevity Corp

ticker: NGVT


text: Our Chief Executive Officer and Chief Financial Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. The CISO is a Boardroom Certified Qualified Technology Expert (QTE) and holds certifications including Certified Chief Information Security Officer (C|CISO), Certified Internal Auditor (BSI) and is a graduate of the Wounded Warrior Cyber Combat Academy. The CISO has experience with regulatory compliance frameworks including ISO 27001, SOX, NIST and CMMC.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: At BAB, Inc. we recognize the importance of safeguarding our systems, data and assets, even in an environment where the risk of cyber incidents is minimal due to the nature of our business. The CFO has over 30 years of experience in risk management and working with computer systems across various industries, providing strong oversight of the cybersecurity efforts. The DFO has several years of experience in IT operations within the company. The internal management team of the CFO and DFO are both familiar and knowledgeable of the company's computer systems and operations and they are familiar with the company's policies, procedures and accountability for safeguarding critical data and assets. Cybersecurity tools as listed below aid in mitigating cybersecurity risk.

companyName: BAB, INC.

ticker: BABB


text: Key aspects of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • a security team principally responsible for managing; (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers and vendors.

companyName: CALIX, INC

ticker: CALX


text: Our cybersecurity management team includes our CISO and Director of Security Operations, Data Privacy Officer, CTO, Chief Financial Officer, General Counsel, and Head of Internal Audit. The CISO, in coordination with the team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The cybersecurity management team meets regularly to review cybersecurity and data privacy strategy, receive updates, and consider the Company's current risk posture. The team meetings also build leadership consensus on cybersecurity risk management and tolerance. In the event they become aware of a cybersecurity threat or incident, employees are expected to follow established lines of communication to notify the relevant members of the cybersecurity management team and allow the relevant team members to coordinate the evaluation and response to such threats and incidents as necessary. To facilitate the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the rest of the cybersecurity management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to other members of senior management and the Audit Committee when appropriate. Such plans also dictate notification responses to Company management based on the severity of the incident.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: We regularly conduct cybersecurity training to ensure all employees are aware of cybersecurity risks and to enable them to take steps to mitigate such risks. For example, all employees are required to successfully complete a cybersecurity risk module and assessment on a quarterly basis. As part of this program, we also take reasonable steps to ensure any employee who may come into possession of confidential financial or health information has received appropriate cybersecurity awareness training and, if applicable, payment card industry (PCI) training.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: Product Security Posture To facilitate identification of security vulnerabilities in our products, we periodically conduct third party penetration tests and participate in the independent Verified By Veracode program, as detailed on its website (https://www.veracode.com/verified/directory/pegasystemsInc) which is included as an inactive reference and the content of which is not incorporated by reference into this Annual Report. We also generate a monthly software bill of materials that identifies open source included in certain of our product offerings and periodically have an independent security assessment firm evaluate the security risks linked to suppliers we use, including source code repositories, the infrastructure employed for software development, and the mechanisms used for software delivery, such as Amazon Web Services ("AWS"), Google Cloud, and Microsoft Azure. Our Chief Product Officer reviews these findings and provides updates to our SSG.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Our board of directors holds oversight responsibility over the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of the Company's processes for monitoring and controlling cybersecurity risks.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: We face a number of cybersecurity risks in connection with our business and we have, from time to time, experienced threats to and incidents involving our data and systems. For more information about the cybersecurity risks we face, see the risk factors captioned "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability " and " We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), adversely affect our business or reputation, and create significant legal and financial exposure." in Item 1A- Risk Factors.

companyName: SouthState Bank Corp

ticker: SSB


text: The CISO leads an Information Security Steering Committee ("ISSC") which convenes expertise from areas beyond the information security and technology departments, including risk, legal and operations, or other departments, as necessary. Accordingly, the ISSC provides for an interdisciplinary expertise in the implementation of our cybersecurity risk management framework. The CISO reports on behalf of the ISSC to management's Risk Committee. These reports include information on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents.

companyName: Federal Home Loan Bank of Indianapolis


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology is responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer. Our current Chief Information Officer has over 20 years of technology experience, including 16 years in Banking.

companyName: HBT Financial, Inc.

ticker: HBT


text: We are intensely focused on protecting the security of our products; our guiding principle of "security and privacy by design" underlies all of our product development. We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy that aligns with FDA guidance. Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible CGMs. Our Secure Software Development Lifecycle enforces application testing and continuous monitoring to identify security risks. Omnipod 5 is certified by ISO (27001, 27017 and 27799) and the U.K. Cyber Essentials. Omnipod 5 incorporates authentication, encryption, and cybersecurity protection to ensure only trusted devices and authorized people can access the system.

companyName: INSULET CORP

ticker: PODD


text: Despite our efforts, there is no guarantee that we can completely eliminate the risk of cyberattacks. Our cybersecurity measures may not be effective against all threats, and new vulnerabilities may emerge that we are unaware of.

companyName: Mega Matrix Corp.


text: o Regulatory Compliance: Management and the board both play a role in overseeing compliance with relevant cybersecurity regulations and legal requirements.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Shake Shack Inc.

ticker: SHAK


text: Our efforts to safeguard the confidentiality, integrity and availability of our systems and data, maintain regulatory compliance and manage our risk from cybersecurity threats include: • maintaining a Security Operations Center to monitor and investigate activity that may be suspicious, • staffing and managing a cybersecurity team to safeguard systems and applications, • routinely auditing the security of critical information technology systems and services, and • conducting regular training and simulations for all employees and contractors with access to our systems to enhance awareness and responsiveness to possible threats.

companyName: STEELCASE INC


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ZeroStack Corp.

ticker: ZSTK


text: Our Information Security Committee (the "ISC") oversees and implements a cybersecurity program that seeks to assess, identify and protect against cyber security threats and detect, respond, and recover from cyber security incidents. The program is modeled upon the National Institute of Standards and Technology Cybersecurity Framework, a well-established and widely adopted framework in the financial services industry. The ISC is chaired by our Chief Information Security Officer ("CISO") and membership includes executive and management level representation from our technology, legal, and compliance departments.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: We view cybersecurity protection and data privacy as a shared responsibility in which all employees are active participants. Each employee undergoes annual cybersecurity training with supplemental training disseminated throughout the year. This continual education helps promote a culture that understands the critical role cybersecurity and data privacy play in protecting our clients' assets. Furthermore, our computing environments, products, and services are reviewed by our internal security team and our controls are tested regularly by independent third-party assessors as part of our annual SOC2 and SOX re-certifications.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Identified as a critical risk factor, cybersecurity threats encompass potential hazards such as malicious code, employee misconduct, advanced persistent threats, fraud, and phishing attacks.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.

companyName: Bone Biologics Corp

ticker: BBLG


text: The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, planned improvements to our cybersecurity program, and the status of information security initiatives. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan, which was developed taking into account industry standard guidance provided by institutes such as the National Institute of Standards and Technology. This plan is a key component of the cybersecurity program, which is generally incorporated within our enterprise risk management framework. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform cybersecurity-related diligence on third parties that have access to our systems, data or facilities. In addition to the KKR CISO and KKR's Chief Compliance Officer, the KKR CIRT includes members of KKR's legal, technology, compliance, risk, public affairs, human capital and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the Risk and Operations Committee, senior members of management, and KKR's Board of Directors and its committees.

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data that is created, collected, stored, and used to operate our business.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE