text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We depend on our information technology systems and those of our CROs, manufacturers, contractors and consultants. Our internal computer systems, or those of any of our CROs, manufacturers, other contractors, consultants, existing or future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use or acquisition of or destruction of our proprietary and confidential data, employee data or personal data, which could result in additional costs, loss of revenue significant liabilities, harm to our reputation and material disruption of our operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, and under the heading "Risks related to employee matters, managing our growth and other risks related to our business."

companyName: BioAtla, Inc.

ticker: BCAB


text: We use third-party service providers to perform a variety of functions throughout our business, including, but not limited to infrastructure support and maintenance, CRM, contract management, data hosting, and miscellaneous finance and accounting projects. We assess our vendors with respect to cybersecurity risk according to the services provided, the sensitivity of the Information Systems at issue, and the provider's identity. In appropriate cases, we will seek enhanced contractual obligations or guarantees related to cybersecurity on the service provider.

companyName: OptimizeRx Corp

ticker: OPRX

secItem: Item 1C


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity tools to monitor, detect, and respond to threats in real-time; • the use of external service providers, to assess, test or otherwise assist with certain aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents and is designed to escalate certain cybersecurity incidents to members of the management team, depending on the circumstances; and • a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.

companyName: CG Oncology, Inc.

ticker: CGON


text: To this end, we have implemented processes and systems designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems to prevent adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Supporting these core information security functions is an Information Security Engineering team within our Engineering organization. This team is charged with the configuration, implementation and ongoing maintenance of the solutions that enhance our security posture.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: In accordance with these policies, we share personal information with affiliates, business partners, third-party service providers, or vendors only when we have a legitimate business purpose for doing so and it is permissible by law. We require third parties to maintain similar standards to ours to protect personal information. We have implemented a risk mitigation process to identify and assess the cyber posture of third parties providing commodities or services to our legal entities. We also have implemented multiple layers of data protection measures.

companyName: Argo Group International Holdings, Inc.


text: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, "Risk Factors."

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Management's Role Managing Risk Our CISO and our management committee on cybersecurity, which includes our CEO, COO and IT Director, are primarily responsible to assess and manage our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our Data Protection Officer ("DPO"), HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming. Our CISO who has been leading the team for over a decade, has 20+ years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: In the event of a cybersecurity incident, we have an incident response process and an escalation process in place to promptly identify, notify and brief the Board, including the Chair of the Technology Committee, outside of the regular reporting process in the event of an emerging or potentially material cybersecurity incident. The Board of Directors may choose to delegate responsibility for oversight of a particular cybersecurity matter to the Technology Committee in its discretion.

companyName: MAXIMUS, INC.

ticker: MMS


text: Additionally, we have policies and procedures in place to help oversee and identify material risks from cybersecurity threats associated with third-party service providers. Prior to engaging vendors, specifically those involved in the processing, storage or transmission of certain data, the information security team completes a due diligence process, including requiring proof of the potential vendor's PCI, HIPAA, HITRUST, and/or SOC 2 compliance, as applicable. During the due diligence process the information security team assigns a risk ranking as it relates to information security risk and may perform additional due diligence if appropriate based on such ranking. Further, we engage an external vendor risk monitoring and alert service to monitor the cyber health of our third-party vendors. If there is a change in the vendor's risk profile, we review the risk and initiate an action plan in response, which could include additional monitoring, remediation requests or termination. If the vendor is a key technology vendor and/or a vendor with access to protected data, any action plan will be escalated to the CISO and require the CISO's approval before proceeding.

companyName: WEX Inc.

ticker: WEX


text: Our CISO and management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our formal information security program includes measures to address: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness. Through these measures, our CISO and management committee on cybersecurity are informed about and monitor the lifecycle (i.e., prevention, detection, mitigation, and remediation) of cybersecurity threats or incidents.


text: The Director of Information Security, along with management, including the CIO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee. The chair of our Audit Committee has experience in assessing and managing cybersecurity risk.

companyName: AXT INC

ticker: AXTI


text: For the fiscal year ending December 31, 2024, no cybersecurity threats were identified that significantly impacted or are expected to significantly impact our business strategy, financial performance, or financial position. However, despite the robust capabilities, processes, and security measures in place, there exists the possibility of undetected vulnerabilities or misjudged risks. While our preventive measures aim to mitigate cybersecurity incidents, absolute security cannot be guaranteed, necessitating ongoing vigilance and adaptability in addressing potential risks.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: The Company has increased its investment into combating cybersecurity risks which include increased Board Audit Committee oversight of IT's security risk reporting, formation of the Cybersecurity Steering Committee to directly govern IT cybersecurity strategies and strengthening the IT security management team which deploys resources to address cybersecurity risks on a day-to-day basis. Our internal cross-functional Cybersecurity Committee meets quarterly to discuss any issues and regulatory updates. The Board's Audit Committee exercises its oversight role and provides the Board with reports and findings from its annual cybersecurity meeting with management, including the Vice President of Global Information Technology and the Senior IT Director over Cybersecurity. Our Senior IT Director over Cybersecurity holds a Certified Information Systems Security Professional (CISSP) certification and has more than 25 years of experience in cybersecurity. Our Board also reviews our cybersecurity budget on an annual basis.

companyName: Magnera Corp

ticker: MAGN


text: The board of directors has authorized and approved our entry into the Services and Secondment Agreement and the Omnibus Agreement with Westlake, and has thereby charged Westlake's Corporate Risk and Sustainability Committee with assisting the board of directors with its oversight of cybersecurity risks, which is a component of our overall enterprise risk management program. As a result, Westlake's Corporate Risk and Sustainability Committee assists with the oversight of our cybersecurity risks. Westlake's Corporate Risk and Sustainability Committee includes directors with cybersecurity experience and expertise, primarily through supervision of information technology departments as executive officers. The board of directors also receives regular updates from Westlake's Chief Information Officer on cybersecurity risks, incidents and trends, and ongoing and planned projects impacting the Partnership and OpCo. Westlake's Chief Information Officer and our senior management receive regular status reports on the Partnership's and OpCo's cybersecurity risks from Westlake's cybersecurity organization. Further, incident updates are reported to our senior management and the board of directors as Westlake's Chief Information Officer and cybersecurity organization consider appropriate, depending on the severity of the incident.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: Our business operations depend significantly on third party service providers. We have processes in place to evaluate the operational and cybersecurity risks posed to us by third parties on whom we are reliant for these services at the inception of our engagement, and we annually review third-party firms that pose the greatest risks to our business and operations from cybersecurity threats. Nonetheless, we rely on the third parties we use to implement security programs commensurate with their own risk, and we cannot ensure that their efforts will be successful.

companyName: AGNC Investment Corp.

ticker: AGNC


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Executive Vice President of Business Intelligence has over 10 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 10 years of professional experience in the information security area.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our Board of Directors (the "Board") plays an active role in overseeing and managing the Company's cybersecurity risks. The Audit Committee of the Board has established a Cybersecurity Subcommittee for the purpose of assessing, analyzing and managing the Company's key cybersecurity and information technology risks, and to ensure that our systems are adequate to protect against security breach and effectively safeguard the Company's IT infrastructure, assets, intellectual property, and data. The roles and responsibilities of the Cybersecurity Subcommittee are determined, from time to time, by the Audit Committee. The Cybersecurity Subcommittee meets quarterly with our management team to discuss various matters relating to IT and cybersecurity risks, and our senior management team communicates and coordinates directly with the Cybersecurity Subcommittee in the event of any cybersecurity incident. The Cybersecurity Subcommittee is given the following responsibilities: • Oversight of policies, procedures, plans, and execution intended to provide security, confidentiality, availability, and integrity of the information. • Oversight of the quality and effectiveness of the Company's policies and procedures with respect to its IT systems; • Review and oversight on policies and procedures of the Company in preparation for responding to cybersecurity incidents. • Oversight of risks related to IT systems and processes, including privacy, network security and data security, and any internal audits of such systems and processes. • Review and oversight of preparation of the Company's public disclosures, including SEC filings, relating to the Company's IT systems, including privacy, network security, and data security, and • Report to the Audit Committee and the Board of significant and material cybersecurity incidents.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: The Company's cyber risk management program is led by the Company's Vice President of Information Systems, whose team is responsible for leading company-wide cybersecurity strategy, policy, and processes while reporting directly to the Company's Chief Financial Officer. While the Board has ultimate oversight for the risk management process, the Audit Committee is responsible for overseeing the Company's policies and procedures for assessing and managing its exposure to risk, including cybersecurity risks. The Company's Vice President of Information Systems provides regular reports to the Audit Committee on any cyber risks and threats to the Company, assessments of the Company's security program and projects in progress to enhance the Company's security systems. The Company's Board of Trustees also receives periodic updates relating to the Company's cybersecurity programs and emerging cybersecurity threats as part of its general oversight duties. Pursuant to the Company's response plan, the Board and the Audit Committee will receive prompt and timely information regarding any material cybersecurity incidents.

companyName: EPR PROPERTIES

ticker: EPR


text: All of our offices use our own gateway consoles, which have intrusion detection features built in. Additionally, access to our key Information Systems requires an in-office network or VPN with multi-factor authentication, and we employ additional protective measures including the use of our proprietary identity management tool. We also use third-party tools to protect our employee laptops and self-hosted servers and have implemented a public bug bounty program that helps to identify vulnerabilities in our products.

companyName: Ubiquiti Inc.

ticker: UI


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 27 years. Staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: Part of our intended program would be ongoing evaluation and enhancement of our systems, controls and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.

companyName: bowmo, Inc.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We use third-party service providers to assist us in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of our environment. We report key findings to the audit committee of the board of directors and, if appropriate, the board of directors and adjust our cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Our SVP and Head of Technology Services, together with the Director Cybersecurity and IT Infrastructure, is responsible for day-to-day management and oversight of our cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The SVP and Head of Technology Services provides regular reporting to Braves Holdings executive management, the CESC and the Audit Committee.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Our Cybersecurity Executive Council ("Council"), which is led by the Chief Information Security Officer ("CISO") and includes our Chief Information Officer ("CIO"), Chief Operating Officer ("COO"), General Counsel ("GC"), Chief Compliance Officer ("CCO"), SVP of Research & Development, Senior Director of Engineering, SVP of Global Services Operations, and AVP of Engineering, oversees NetScout's cybersecurity program, including strategy, threats, risks, and mitigations. The CISO, who reports to the CIO, and the Senior Director of Engineering, who reports to the SVP of Research and Development, with oversight by the Council, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and NetScout's risk profile using various methods such as implementing manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of certain threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments to identify vulnerabilities, and engaging in tabletop incident response exercises.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: As a data-driven company, we may be a potential target for cyberattacks and may be exposed to a number of cybersecurity risks in the normal course of operations. Our success as a business may depend upon our ability to address these risks, and to keep our platform and internal systems secure for the benefit of our merchants, users, business partners, employees, and other stakeholders.

companyName: ContextLogic Inc.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading "Arcadia's business is subject to the risks of security breaches, including cybersecurity incidents." in Item 1A, "Risk Factors" of Part I of this Report.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: We have implemented solutions, processes, and procedures to help mitigate the risk of cyberattacks, such as conducting annual vulnerability testing, and periodically engaging third-party experts to assist us with tasks such as implementing our incident response plan and conducting tabletop exercises.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: Employees with access to the Company's network receive annual training information and updates on topics such as phishing, malware, and other cybersecurity risks.

companyName: TREES Corp (Colorado)

ticker: CANN


text: CEL-SCI employs third-party information technology ("IT') consultants to manage its information technology environment and help manage and assess cybersecurity risks. The third-party IT consultants have relevant industry experience, including security solutions and data protection and recovery. Using various monitoring and detection tools implemented into CEL-SCI's internal technology systems, they can identify cybersecurity threats and report such risks to CEL-SCI's management team.

companyName: CEL SCI CORP

ticker: CVM


text: The Company utilizes various technical and qualitative processes to assist in identifying, assessing and managing cybersecurity risks. The Company's processes include periodic discussions and risk reviews with management. These processes also include, depending on facts and circumstances, internal audits, third-party assessments, post-remediation reviews, engagements with independent third-party service providers and key governmental agencies, regular employee training, an incident response plan and backup and recovery plans. Our periodic engagements with independent third-party service providers are designed to provide qualitative and technical cybersecurity assessments. The Company has a corporate-level cybersecurity team, led by the CISO, that, among other responsibilities, receives and reviews reports regarding potential threats, trends and remediation strategies. The cybersecurity team evaluates threat intelligence and information obtained from various sources, including internal, public or private sources, government agencies and external consultants. Certain of the Company's subsidiaries have separate cybersecurity teams that, along with the corporate-level cybersecurity team, play a role in the Company's efforts to monitor, identify, assess and manage cybersecurity risks.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: We provide our employees and consultants with privacy, data protection, cybersecurity incident response, and prevention education and awareness training, which includes annual and supplemental training covering relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform phishing test campaigns on at least a quarterly basis to reinforce identification and reporting training.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Our Board oversees our enterprise risk management program and practices, and the Audit Committee assists the Board in its oversight of cybersecurity matters. Quarterly updates are presented to our Audit Committee by our Chief Information Security Officer ("CISO") on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess, and manage our key cybersecurity programs and risks, and, as necessary, responses to any significant cybersecurity incidents.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors – Market, Legal and Regulatory Risks – We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."

companyName: Oaktree Gardens OLP, LLC


text: The Board and the Audit Committee of the Board ("Audit Committee") are actively involved in oversight of our cybersecurity risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.

companyName: FORWARD AIR CORP

ticker: FWRD


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experience any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require will implement a cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber designing and evaluating our cybersecurity program, we will adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment and management processes and does not equate to compliance with any specific technical standards or requirements.

companyName: Idaho Copper Corp

ticker: COPR


text: Chief Information Officer ("CIO") has extensive experience in managing complex IT environments and mitigating cybersecurity risks. The CIO is responsible for overseeing cybersecurity and technology vendors, assessing risks in these areas, and ensuring the effective execution of the information security program.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials("Information Systems and Data").

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our management is generally responsible for assessing and managing risks from any cybersecurity threats, including through the use of the third-party information technology consultant who reports to our management on actions that he is undertaking and the cybersecurity threats that he sees to our information technology network. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to the Audit Committee of our Board of Directors (which is the committee of the Board of Directors to which oversight of cybersecurity matters and management of cybersecurity incidents has been delegated by the Board of Directors) for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the Audit Committee or the Board of Directors deems appropriate to take. In addition, our management reports to the Audit Committee on a regular basis on the potential for risks from cybersecurity threats.

companyName: GigCapital7 Corp.

ticker: GIG


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Additionally, we regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: Our VP of IT/CISO and CFO are responsible for assessing and managing our material risks from cybersecurity threats. The cyber security risk management team is led by our VP of IT/CISO, who has significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: The AEOC regularly discusses with management, including our Chief Technology Officer, our enterprise risk management process, including our cybersecurity exposures, the steps management has taken to monitor and control such exposures and guidelines and policies to govern our risk assessment and risk management processes. The AEOC periodically reports to the Board regarding significant matters identified with respect to the foregoing, including, among others, our risk assessment and risk management approach to cybersecurity.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan based on National Institute of Standards and Technology (NIST) 800-61.

companyName: Commerce.com, Inc.

ticker: CMRC


text: Bunge's dedicated cyber risk organization meets regularly with business units and corporate operations to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the global enterprise. We invest in broad cybersecurity awareness and training to educate those with access to Bunge's networks, which includes a review of company policies and best practices. We conduct phishing tests to train our workforce, and assess its ability, to identify and report malicious emails and activity. Privacy and data protection awareness and training is provided to employees and the Board as part of Bunge's required Code of Conduct training.

companyName: Bunge Global SA

ticker: BG


text: Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks, and are regularly briefed by management on risk management considerations. One of the primary tools that facilitates the Board's oversight and mitigation of risk is the Company's Enterprise Risk Management ("ERM") Program, which is designed to look holistically at risks which may cause a material, adverse impact to the Company's operations, reputation, or value. As part of the ERM Program, our Chief Operating Officer directs and chairs the ERM Steering Committee, which is comprised of members of senior management, including our Chief Financial Officer, General Counsel, Chief Information Officer, Chief Information Security Officer, Chief Administrative Officer, and Chief Ethics and Compliance Officer.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our Information Technology team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber-attacks.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: The CFO provides periodic reports to our Audit Committee, as well as other members of our senior management as appropriate. These reports occur at least annually and include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: CRH's operating companies and business units use a variety of tools and processes to identify and manage material cybersecurity risks. CRH utilizes multiple monitoring tools and practices to identify and detect unusual activities and/or potential cybersecurity incidents, including potential system breaches, and to verify the effectiveness of protective measures. CRH's operating companies and business units implement various risk mitigation strategies, including continuously strengthening security measures, improving incident response plans through post-incident evaluations and assessments, investing in security technologies, providing regular and focused employee training, and transferring risk through cybersecurity insurance.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Company's Audit Committee is briefed on cybersecurity risks at least once each calendar year and as necessary with respect to any material cybersecurity incidents. The Audit Committee also reviews the enterprise risk management matrix presented by the Risk Committee on an annual basis. The process of reviewing the matrix includes an overall assessment of the Company's compliance with cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: COMFORT SYSTEMS USA INC

ticker: FIX


text: To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our consolidated operations or financial results, or in any penalties or settlements. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. However, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a Chief Information Officer, who reports to the CFO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Currently, the security of our information is managed by Levi Jacobson, our sole officer and director. While Mr. Jacobson believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as appropriate. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which certain significant or potentially material incidents would be communicated to executive management, our BOD, external regulators and shareholders, as appropriate. • Enterprise-Wide Coordination: We engage relevant stakeholders from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.

companyName: PFIZER INC

ticker: PFE


text: It is the responsibility of our board of directors to monitor and assess potential strategic risk exposure. Our board of directors administers its oversight function as a whole, as well as through the Audit Committee. Our executive management team informs the Audit Committee on cybersecurity risks periodically, with a minimum frequency of once per year.

companyName: Capstone Holding Corp.

ticker: CAPS


text: Security Incident Response Plan. We have a security incident response plan in place. The incident response plan is a set of coordinated procedures that our incident response team executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents.

companyName: Construction Partners, Inc.

ticker: ROAD


text: As a government contractor, we have designed our cybersecurity risk management program to align with the National Institute of Standards and Technology (NIST) standards and comply with extensive regulations, including but not limited to U.S. government cybersecurity regulations. Additionally, our cybersecurity program is routinely assessed by the government, and our network is penetration tested biannually by a third-party independent assessor. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks. We require them to comply with applicable laws and regulations, including implementing certain security controls and complying with certain reporting obligations. Although we perform due diligence on all service providers to identify potential cybersecurity risks and establish controls through onboarding procedures and contractual requirements, our ability to monitor the cybersecurity practices of our service providers and ensure that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks, and other assets owned or controlled by our vendors is limited.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: The Company has implemented a governance framework related to cybersecurity that includes operational risk-mitigation practices and Board-level cybersecurity risk oversight.

companyName: Sandisk Corp

ticker: SNDK


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our networks and systems. Our CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.

companyName: Criteo S.A.

ticker: CRTO


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. We employ continuous monitoring systems and other technologies and security controls to assist us with the identification of cybersecurity risks and threats. At least annually we conduct a third-party risk assessment to identify cybersecurity risks associated with third-party vendors and service providers. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity and vulnerability, considering both quantitative and qualitative factors. These strategies include, among others, the application, adoption or modification of cybersecurity policies and procedures, implementation of administrative, technical and physical controls and employee training, education and awareness initiatives.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: To defend, detect and respond to cybersecurity incidents, we (i) conduct proactive privacy and cybersecurity reviews of systems and applications, (ii) audit applicable data policies, (iii) perform penetration testing internally and with external independent third-parties to test our security controls, (iv) conduct employee training, (v) monitor emerging laws and best practices related to data protection and information security and (vi)

companyName: Bandwidth Inc.

ticker: BAND


text: Management's Oversight and Responsibilities Reporting to the CIO, the CISO manages Cybersecurity at Clean Harbors and is a Certified Informational Systems Security Professional. The CISO leads the Clean Harbors' cybersecurity response program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework providing a collaborative, balanced risk based approach to securing and defending the Company.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Our Board previously had a Technology and Innovation Committee which oversaw jointly, alongside the Audit Committee, matters of technology, innovation, cybersecurity and information security. The Technology and Innovation Committee was dissolved in September 2024 as part of the Company's Board restructuring and its responsibilities were redistributed to the Audit Committee. The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. The Audit Committee oversees cybersecurity disclosures and receives periodic reports from management and the IT team. Further, the Audit Committee periodically discusses the Company's actions to identify and detect threats, as well as its cybersecurity strategic roadmap.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: We utilize a combination of technology and active monitoring that are integrated within our enterprise risk management network system to promote security awareness and prevent security incidents that are consistent with recognized standards and practices for information technology and cyber security. Our process for addressing risk aligns with industry standards as outlined in the NIST Cybersecurity Framework and NIST Risk Management Framework.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: We have implemented a risk management program to identify and track information risks, including cybersecurity threats, from many different sources, including third parties, technology projects, acquisitions, risk assessments, technical assessments, and internal/external audits, and assess them based on severity. Our annual information technology general control testing, which is conducted in connection with our internal control over financial reporting review process, and periodic reviews of risks and controls related to cybersecurity threats that may impact financial reporting control objectives also serve to identify and track information risks. Additionally, we partner with independent third-party service providers to regularly perform cybersecurity assessments, such as network and application penetration testing.

companyName: Performance Food Group Co

ticker: PFGC


text: Our management, represented by our Chief Financial Officer and Vice President, Information Systems, lead our cybersecurity risk management processes and oversees their implementation and maintenance. Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters. As described above, we also have engaged a third-party IT and cybersecurity firm that works closely with our management to implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. Our management and information systems teams, oversee the work of our third-party IT and cybersecurity firm and regularly communicates with members of the team. Members of this third-party IT and cybersecurity team have collectively over 55 years of prior work experience and are responsible for the implementation of our cybersecurity strategy and responses as well as individuals having the position of cybersecurity analyst, cybersecurity engineer. In addition, our Vice President, Information Systems, has 40 years of prior work experience in information systems and technology, including with respect to cybersecurity issues and threats.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Item 1A. "Risk Factors—Risks Related To Information Technology, Cybersecurity and Data Privacy—System interruptions that impair customer access to our website or other performance failures in our or our third-party vendors' technology infrastructure could damage our business, reputation and brand and substantially harm our business, financial condition and results of operations."

companyName: FIGS, Inc.

ticker: FIGS


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also integrate security measures into our digital products and services.

companyName: DOVER Corp

ticker: DOV


text: A well-defined incident response plan that enables us to quickly identify, contain, and mitigate the impact of cybersecurity incidents.

companyName: QHSLab, Inc.

ticker: USAQ


text: We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. For example, to identify and assess risks from cybersecurity threats, our enterprise risk management program considers cybersecurity as part of the Company's risk assessment process, and our risk management framework requires risk owners to monitor key risks such as cybersecurity on a continuous basis. See Item 1, " Business—Enterprise Risk Management " for additional information.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Our cybersecurity policies, standards, processes, and practices are designed to provide reasonable information security given the integrated nature of our organization, our third-party relationships, and the geographic regions we operate in. With this multi-layered approach, we aim to mitigate cybersecurity vulnerabilities across all aspects of our operations. Our approach to cybersecurity is grounded in the NIST Cybersecurity Framework v1.1, a nationally recognized and adaptable model that aligns with our goals, and addresses the following key areas:

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: TRANS LUX Corp


text: We rely on a multidisciplinary team, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, and conducting threat and vulnerability assessments.

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP


text: Depending on the environment, we implement and maintain various technical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: Our cybersecurity risk management function is led by our Cybersecurity Management team which is comprised of our Chief Information Security Officer (CISO), Chief Technology Officer (CTO), members of our Information Technology (IT) department, as well as members of our Legal and Compliance Departments. Our Cybersecurity Management team is primarily responsible for developing, implementing and monitoring our cybersecurity program and reporting on cybersecurity matters to senior management as well as our board of directors.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Certain of our data processing equipment is housed in third-party commercial data centers or on servers owned and operated by cloud-based service providers. We generally enter into service level agreements with these parties that include provisions for the implementation and operation of effective security controls at the third-party organizations. We have experienced, and may in the future experience, whether directly or through our third party providers, cybersecurity incidents. While risks from cybersecurity threats, including prior incidents, have not had a material impact on us, future incidents could have a material impact on our business strategy, results of operations, and financial condition. For additional information about our cybersecurity risks, please refer to "Risks Related to Intellectual Property and Technology" in Item 1A, "Risk Factors."

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: As part of its overall risk oversight function, our Audit Committee, which is comprised entirely of independent directors, oversees cybersecurity risks in connection with overseeing our overall enterprise risk management system. Management, including our CISO and CIO, provide updates on our cybersecurity risk management program and cybersecurity matters to the Audit Committee, and also reports to the Board of Directors as necessary. These updates and reports include updates on Teva's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats and alerts received by the Bank's ISO, Management or Technology Administrator.

companyName: River Financial Corp

ticker: RVRF


text: Leading the Company's cybersecurity risk management and strategy at the management level is our Vice President of Information Security, who reports directly to the Vice President of Information Technology. The Vice President of Information Security has been with the Company for over 19 years, serving in various capacities with deep understanding of the underlying architecture, technologies, and systems utilized by the Company. The Vice President of Information Security and his team are responsible for designing and implementing the Company's strategies, policies, and processes to assess, identify, and manage risk related to cybersecurity threats, along with threats associated with our use of third-party service providers. A combination of widely accepted tools, relationships with external experts, in-house expertise, and in-house technologies are integral to the Company's strategy for managing cybersecurity threats. The Company executes ongoing assessment and testing of processes and practices through regular teammate training, phishing exercises, network and endpoint monitoring, penetration testing, vulnerability scanning, and attack simulations. The Company's incident response plan is based on recognized industry security standards and control frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Third parties are also engaged to perform assessments and validate the Company's cybersecurity measures, including information security maturity assessments and independent reviews of the operating effectiveness of the information security control environment.

companyName: BUCKLE INC

ticker: BKE


text: The Company continues to expand investments in Information Technology security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting. We emphasize continuous training for our staff to improve their ability to identify and address diverse cybersecurity threats. We invest in cybersecurity technology and talent to support this endeavor. Furthermore, we conduct thorough reviews of our vendors and mandate specific security standards for third-party providers. Our comprehensive policies and procedures are designed to safeguard the integrity and security of information collected by us and our service providers on our systems. Additionally, we have implemented security measures to prevent unauthorized access to personal data and minimize the consequences of potential incidents. We consistently learn from any event and look at postmortem improvements where necessary to enhance our security and resilience.

companyName: NBT BANCORP INC

ticker: NBTB


text: Ladder conducts routine risk assessments to identify cyber threats and vulnerabilities and assess the likelihood of occurrence and severity of the impact of such threats and vulnerabilities on the Company. Ladder regularly updates the risk assessment in order to inform Ladder's cybersecurity program and controls and to prioritize risk mitigation and remediation in an evolving threat landscape. Ladder maintains cybersecurity policies and procedures designed to manage these risks and ensure that the Cybersecurity Team and other relevant employees are informed of cybersecurity incidents in a timely manner. These policies include incident response, data classification, physical and network security polices, remote access, record retention and secure destruction policies. The Cybersecurity Team conducts a formal evaluation of Ladder's applicable policies and cyber risks and mitigants on at least an annual basis. Ladder's outsourced technology firm, as well as internal auditors, participate in this evaluation.

companyName: Ladder Capital Corp

ticker: LADR


text: Given our company's small size, limited staff, and minimal resources, we have not yet developed or implemented specific cybersecurity risk management programs to safeguard the confidentiality, integrity, and availability of our essential systems and data.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. Our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise comprised of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies, structures and systems in place for managing risks of the business, including cybersecurity risk. Our executive management team reviews and prioritizes significant risks, allocates resources for risk mitigation. Our Chief Risk Officer and other members of our risk management team provide reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk. We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: To protect our information systems from cybersecurity threats, we employ technical processes as a crucial component of our multi-layered cybersecurity risk management program. These processes include firewalls, intrusion detection and prevention systems, access controls, endpoint protection, data encryption, vulnerability management, security information event management, data loss prevention, regular security assessments, and penetration testing. Our technical processes are regularly reviewed and updated.

companyName: Waystar Holding Corp.

ticker: WAY


text: We have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: Security Updates and Backups. We monitor security bulletins, software updates/patches, and functional software updates/patches and apply them in accordance with the timeline prescribed in our policies and based upon recommendations from third -party vendors, as applicable. Systems that no longer provide security updates/patches are discontinued. We research, test, and verify functional software updates/patches before installation. We perform data backups periodically based on business requirements to maximize data availability and prevent information loss, including before any system upgrade or maintenance. Encrypted data remains encrypted throughout our backup processes. Data backups are stored in geographically separate facilities.

companyName: Clene Inc.

ticker: CLNN


text: Furthermore, the Company has established processes for communicating an incident that is determined material, based on the Company's materiality assessment, to the Audit Committee. This process is designed to help implement a containment strategy and to comply with applicable regulations. The Company's Incident Response Plan focuses on the following goals: reduction of damage due to a security incident; identifying potential opportunities for eradication; identifying potential recovery strategies; establishing lesson learned analyses; and identifying mitigation strategies designed to decrease the likelihood of security incident reoccurrence.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds or that management otherwise deems to be significant, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: The independent members of the Board, through the Board's nominating procedures and requirements, considers cyber expertise in vetting nominees for the Board and recommending Board committee appointments.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: Independent Third-Party Assessments We engage an independent third party to conduct assessments of our cybersecurity program approximately every 18 months. This independent third-party assessment includes an evaluation of our cybersecurity controls based on the NIST Cybersecurity Framework.

companyName: Zoetis Inc.

ticker: ZTS


text: For a description of the risks from cybersecurity threats that may materially affect us, including our business strategy, results of operations or financial condition, and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "A cyberattack could lead to a material disruption of our information technology ("IT") systems or the IT systems of our third-party providers and the loss of business information, which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs."

companyName: AIR LEASE CORP

ticker: AL


text: We maintain cybersecurity awareness training for our employees and periodically perform phishing simulations. We routinely communicate with employees about the potential for cybersecurity threats, including the latest adversary trends and social engineering techniques and how to avoid them, and the best use of our established communications channels.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Our Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our IT security team, led by the Head of Global Information Security, Governance and Architecture ("Head of Global ISGA"), is responsible for managing and directing the day-to-day information security strategy of the organization, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of Global ISGA reports to our Head of Global Information Technology. The Head of Global ISGA routinely reports on cybersecurity risks, projects, and initiatives to the Head of Global Information Technology, who regularly reports to executive management and the audit committee on these matters as described above.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: To date, Avalo has not identified any cyber event or risks from cybersecurity threats that could be considered material, individually or in the aggregate. Notwithstanding our vigilance and our Program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further information, refer to Section 1A, Risk Factors, for a discussion of risks related to cybersecurity and technology.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: Implementing MFA protections for our treasury customers by prohibiting their initiation of ACH transactions or wire transfers until they authenticate their identities using a security token that is generated and sent by our online-banking MFA system; Monitoring electronic mail and other network intrusion attempts with various tools to identify and stop intrusion and malware threats;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Also, as part of our cybersecurity program, we partner with a third -party information technology firm to support and evaluate our cybersecurity and informational security program. This third -party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Risk Management Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: COHERENT CORP.

ticker: COHR


text: Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: Related to Cybersecurity Risks Our Vice President, Head of Information Technology meets periodically with representatives from our external Managed Services Provider ("MSP") to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats. The individual who currently holds the title of Vice President, Head of Information Technology has over 20 years of experience in information security and cybersecurity risk management. Our Vice President, Head of Information Technology reports to the Chief Financial Officer.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Our management team, including the General Counsel and Chief Administrative Officer and Senior Director, IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.

companyName: HilleVax, Inc.


text: ) and the CISO of Athene (" AHL's CISO "), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates. Collaborative Approach.

companyName: Apollo Infrastructure Co LLC


text: As we advance our business operations, we recognize that our cybersecurity needs may evolve. The Company plans to enhance its cybersecurity measures in line with its business growth and the increasing complexity of cyber threats. This may involve implementing more advanced cybersecurity technologies, engaging external cybersecurity expertise, and developing comprehensive incident response plans.

companyName: NEXIEN BIOPHARMA, INC.

ticker: NXEN


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.

companyName: Personalis, Inc.

ticker: PSNL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.

companyName: Viewbix Inc.

ticker: VBIX


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: NeuroPace Inc

ticker: NPCE


text: Our collaboration with third parties includes cybersecurity audits, threat assessments, and consultation on security enhancements. We have established processes designed to manage the cybersecurity risks associated with working with third-party service providers. We evaluate the risks associated with third parties before engagement and maintain ongoing monitoring of such third parties designed to ensure compliance with our security standards. This includes security questionnaires and assessments, as well as external attack surface management. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: proactively inform our customers of substantive changes related to customer data handling through disclosures in our SOC 2 Type 2 report or other contractually mandated disclosures; conduct annual cybersecurity training for employees and contractors with access to PDF systems and sensitive data; conduct incident management training and practice for individuals with responsibilities responding to a cyber incident;

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: The Company recognizes the security of our banking operations and the confidentiality, security and availability of the information that the Company collects and stores, is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. The Company has implemented a comprehensive cybersecurity risk management program that we believe is reasonably designed to mitigate these risks and protect sensitive customer data, financial transactions and our information systems. Key components of the cybersecurity risk management program include:

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 30 years of cybersecurity experience, 5 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: •"—Delays, costs, and disruptions that result from upgrading, integrating, and maintaining the security of our information and technology networks and systems could materially adversely affect us,"

companyName: ADT Inc.

ticker: ADT


text: Managing Material Risks & Integrated Overall Risk Management Our cybersecurity team, led by our CISO, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, through manual and automated tools, internal and external audits, third-party threat assessments and third-party conducted red/blue team testing and tabletop incident response exercises and by subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats and conducting vulnerability assessments.

companyName: CYTOKINETICS INC

ticker: CYTK


text: The Company's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems, and those that are offered to residents and tenants are integral to the operation of the business. The Company utilizes these systems, among others, for financial analysis, management, and reporting, for facilitation of operations, including monitoring and optimization of various building management systems, for initiation, generation, and completion of resident leasing, for internal communications, and for various other aspects of the business.

companyName: Veris Residential, L.P.


text: The company also maintains procedures for screening and evaluating third-party providers prior to granting access to the company's information systems. The company assesses each such prospective supplier's system security in light of the product or service to be provided to the company. The security team analyzes high-value or high-risk third-party suppliers through interviews and surveys prior to engagement. Additionally, the company reviews third-party suppliers on an ongoing basis post-engagement to identify any changes in their security risk profile, including the occurrence of cybersecurity events affecting such suppliers.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Lionheart Holdings

ticker: CUB


text: Our company is exposed to a variety of evolving cybersecurity risks. We invest in our cybersecurity program to manage and mitigate these risks. On an annual basis, we utilize our Enterprise Risk Management ("ERM") program to estimate our annual loss potential based on our defined control framework and its overall effectiveness. In conjunction with our ERM program, the cybersecurity program references the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF) to guide our organization's risk identification and mitigation procedures. In addition, we undergo an annual third-party external PCI penetration test, as well as third-party attack-surface monitoring to understand our potential vulnerabilities, threat vectors, and additional impacts to critical assets and operations. In addition, our cybersecurity team performs procedures to identify risks that inform our annual security roadmap. We also periodically review our cybersecurity policies and require cybersecurity training for our employees.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Our executive team is actively involved in overseeing our cybersecurity operations to ensure that they meet industry standards. The executive team provides regular updates to the board of directors – specifically the audit committee – on the status of our cybersecurity efforts, including any potential risks, threats or incidents.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Assess. In addition to in-house assessments, we engage with security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities, including conducting penetration testing. We conduct risk assessments and audits to identify new risks and include any newly identified risks in remediation planning, as well as confirming that previously identified risks have been remediated. Identified risks are included in a central risk register and assigned an overall risk score. Risk levels are assigned based on a number of factors, including the nature of the risk and likelihood of exploitation. Lastly, we create remediation plans to bring unacceptable risks to an acceptable level.

companyName: Cars.com Inc.

ticker: CARS


text: Like all companies that utilize technology, we face significant cybersecurity threats that include, among other things, attempts to gain unauthorized access to sensitive student and employee information; attempts to compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them; insider threats; malware; ransomware; threats to the safety of our directors, officers and employees; and threats to our facilities, infrastructure and service. As cybersecurity threats may arise, the cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of a perceived threat or possible cybersecurity incident, the cybersecurity team is trained to assess, among other factors, student safety impact, data and personal information impact, the possibility of business operations disruption, projected cost, if any, and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.

companyName: Karman Holdings Inc.

ticker: KRMN


text: Cybersecurity is an important part of our risk management processes. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive reports of any breaches or developments regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Audit Committee and Board members may also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: ACM Research, Inc.

ticker: ACMR


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors—Our hotel managers and we rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: • Our information security processes are built upon a foundation of advanced security technology, a trained team of security experts, and operations based on various global practices, standards, and frameworks, including the International Organization for Standardization, International Electrotechnical Commission, and National Institute of Standards and Technology Cybersecurity Framework. • We maintain policies, procedures, and controls that are designed to identify, protect, detect, respond to, and recover from information security and cybersecurity threats and incidents. Such items are reviewed, approved, and maintained by our CISO on an ongoing basis. In addition, we engage external advisors periodically to review and assess our policies, procedures, and controls. • Our CIRP provides a documented framework for handling cybersecurity incidents. The CIRP addresses cybersecurity incident detection, containment, analysis, eradication, recovery, escalation protocols, and coordination across multiple functions of the organization. • We have processes to manage cybersecurity risks associated with third-party service providers. Such providers are subject to information security assessments at the time of onboarding and at certain other times during their engagement with us. We require our providers to meet appropriate security requirements, controls, and responsibilities and comply with certain cybersecurity and data security standards that we have. We monitor compliance with these standards and investigate security incidents to take appropriate actions as necessary. However, despite the controls that we have in place, we also rely on our third-parties to implement security programs and we cannot ensure in all circumstances that their efforts will be successful. • We maintain an annual cybersecurity training plan including employee training on cybersecurity risks, requirements, and incident reporting. As part of our training plan, we regularly perform phishing tests of our employees. In addition, our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene, incident reporting process, as well as physical security best practices. On an annual basis, our employees must complete cybersecurity awareness training. • We perform simulations and drills to review and test our information security program, including tabletop exercises, penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. • We maintain insurance to provide coverage for certain losses from cybersecurity threats and incidents. • We have developed business continuity and disaster recovery capabilities to mitigate interruptions to critical information systems and the loss of data and services from the effects of natural or man-made disasters to Teradata systems.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our domestic cybersecurity program is overseen by our Head of Cybersecurity, Louie Garcia. Mr. Garcia has over 18 years of cybersecurity experience, spanning threat perspectives, cyber exercise development and training, enterprise vulnerability assessments, defensive and offensive network solutions and operational evaluation of cyber products.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least quarterly and assess the vendor-provided System and Organization Controls (SOC) 1 or SOC 2 report on an annual basis. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: HEARTLAND EXPRESS INC

ticker: HTLD


text: The HEI CFO oversees all IT and cybersecurity matters at HEI, including having oversight responsibility for the services delivered under the SLA. Since the HEI CFO does not have expertise in cybersecurity, the HEI CFO works with the Hawaiian Electric CISO and, if necessary, with third-party cybersecurity consultants on assessing, identifying, and managing material cybersecurity matters impacting HEI. There were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect HEI, including its business strategy, results of operations or financial condition.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we face a number of cybersecurity risks in the normal course of our business and, from time to time, experience threats to our data and systems, including malware and computer virus attacks. Notwithstanding the extensive measures we employ to address cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that would be reasonably likely to materially affect us. Although we maintain cybersecurity insurance, the costs we incur related to cybersecurity threats or disruption may not be fully insured. See "Item 1A. Risk Factors" in Part I of this Annual Report on Form 10-K for more information regarding the risk factors associated with cybersecurity risks.

companyName: M/I HOMES, INC.

ticker: MHO


text: The company's board of directors oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.

companyName: FLOWERS FOODS INC

ticker: FLO