text: We have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers. These reviews are conducted at onboarding and periodically throughout the tenure of the service provider based on risk tier rating of each service provider. We believe these processes enable us to evaluate a third-party service provider's security posture, identify risks that may arise out of our use of the third party's service, and make decisions regarding acceptable levels of risk and risk mitigation.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Technology Risk Committee Members of the Technology Risk Committee include officers with expertise in cybersecurity risk oversight, such as the Chief Security Officer described above and the head of our Technology Risk Oversight department. As of December 2024, several members of the Technology Risk Committee had prior work experience in cybersecurity and several had a relevant degree or certification, or other knowledge, skills or background in cybersecurity.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA

secItem: Item 1C


text: Assessing, Identifying and Managing Cybersecurity Risks — We strive to align our cybersecurity operating model with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to enhance our ability to protect, detect, respond, and recover from potential cybersecurity threats. Our cybersecurity team actively works to assess, identify and manage risks in our information systems in order to protect the confidentiality, integrity and availability of our digital infrastructure. The cybersecurity team meets regularly to evaluate potential threats, discuss best practices and identify new solutions to help mitigate cyber risks.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Additional information about cybersecurity risks we face is discussed in Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by the Corporation or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.

companyName: HESS CORP


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Reducing unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Documenting, approving, and testing changes to security configurations. • Assessing and removing or disabling exploitable files and services based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers with respect to security maintenance and reporting responsibilities in accordance with contract provisions and that service providers provide notification of system security breaches that may affect us.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Daily operations are monitored by a dedicated team of information technology professionals complemented by management's monitoring of critical information security monitoring reports along with our third-party security vendor who provides for 24x7 monitoring of our external connections and email system. Defined incident response procedures are maintained, including a requirement that our security vendor notify designated members of management when unusual or suspicious activity is identified.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: The Corporation considers cybersecurity a subset of information security, and as such, cybersecurity risks and controls are assessed in our information security risk assessment and managed in our Information Security Program (ISP). The ISP is developed and maintained utilizing the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook and represents the standards, policies, procedures, and guidelines defining the Corporation's security requirements and related activities, which includes risk management and risk assessment practices. Management has designated the Information Security Officer (ISO), along with the Systems and Information Technology (IT) Steering Committee, with implementing and monitoring the ISP. The Corporation's IT department consists of the Chief Information Officer (CIO), who has over 40 years of experience in the IT field, including 15 with the Corporation, and other key personnel who have years of experience and various certifications related to assessing and managing cybersecurity risk. Additionally, the Corporation has established a comprehensive enterprise risk management program to monitor risks related to its operations, including cybersecurity risk, and the Corporation's Chief Risk Officer has primary responsibility for the enterprise risk management program. Management also engages the services of third parties to assist the ISO with their tasks. The Corporation believes that risk management is a component of overall governance and that IT risk management is a component of overall risk management.

companyName: C & F FINANCIAL CORP

ticker: CFFI


text: Additionally, cybersecurity risks and threats that could have a material impact on the Company are discussed further in the Item 1A Risk Factors. Those sections of Item 1A should be read in conjunction with this Item 1C. Governance.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Our ICSPP is overseen by the SMT, which is responsible for designating the CISO. The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security. Our ICSIRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the ICSIRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third -party contractors.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Advanced endpoint protection solutions Next-generation firewalls and intrusion detection/prevention systems Data loss prevention tools and encryption for sensitive data Multi-factor authentication for all critical systems and applications Regular vulnerability scanning and penetration testing Continuous monitoring of our network and systems We conduct regular risk assessments of our infrastructure, applications, and processes to identify vulnerabilities and implement appropriate controls. These assessments incorporate:

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Our accounting and financial reporting platforms and related systems, and those that we, or our third-party service providers, offer to TPHGreenwich's tenants are necessary for the operation of our business. We use these platforms and systems, among others, to manage our tenant relationships, for accounting and financial reporting, and for other recordkeeping purposes. Our business operations and financial reporting rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: While our board of directors has oversight responsibility for risk management generally, the Audit and Finance Committee ("Audit Committee") is specifically responsible for overseeing our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our CISO provides quarterly updates to the Audit Committee in this regard, and covers the state of our cybersecurity program, supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third-party service providers; the board will be informed promptly of material risks from cybersecurity threats.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: As part of our enterprise risk management program, the Board of Directors (the "Board") and Audit Committee meet with our senior management team, which includes our Chief Executive Officer, President, Chief Financial Officer, and General Counsel to address risks associated with cybersecurity threats on a regular basis. The Board and the Audit Committee receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: Our Information Security Coordinator, members of our incident response team and our third party consultants each have extensive experience in the information technology area. The Chief Information and Compliance Officer has over 11 years of experience in the information technology area and holds a Master of Business Administration with a focus in Technology from Oklahoma Christian University. Additionally, our Vice President of Technology and Analytics has 11 years of professional experience in the information security area.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our Chief Product Officer has been with Pega for thirty-two years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate.

companyName: EyePoint, Inc.

ticker: EYPT


text: Program and Incident Response Our CISO is responsible for our cybersecurity program, including risk assessments, information security activities, and controls. The CISO is responsible for establishing and maintaining corporate information security policies and overseeing our risk management activities, which prioritize vulnerability management, risk reduction, and prevention. Our CISO also leads our Cyber Defense and Incident Response ("CDIR") team which identifies, assesses, escalates, and remediates cybersecurity incidents. Our CISO has over 30 years of experience in the field of cybersecurity, bringing an extensive understanding of cybersecurity threats, regulatory compliance, and industry best practices.

companyName: lululemon athletica inc.

ticker: LULU


text: ASGN maintains a vigilant approach to cybersecurity and operational readiness, with cybersecurity practices designed to reduce the impact of any incident. ASGN has business continuity and disaster recovery policies. Our plans are tested annually to confirm critical business functions can continue with minimal disruption in unforeseen circumstances.

companyName: ASGN Inc

ticker: ASGN


text: Finally, we have implemented encrypted virtual private networks for remote connections. The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered as an important component of our enterprise-wide risk management approach.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise-level and subsidiary level generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: We have adopted various tools and methodologies to manage cybersecurity risk that perform testing and scrutiny on a regular cadence. We have also adopted a process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property.

companyName: NeuroMetrix, Inc.


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our CAO to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.

companyName: Antero Midstream Corp

ticker: AM


text: Our company is exposed to a variety of evolving cybersecurity risks. We invest in our cybersecurity program to proactively manage and mitigate these risks. On an annual basis, we utilize our Enterprise Risk Management ("ERM") program to estimate our annual loss potential based on our defined control framework and its overall effectiveness. In conjunction with our ERM program, the cybersecurity program references the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF) to guide our organization's risk identification and mitigation procedures. In addition, we undergo an annual third-party external penetration test, as well as third-party attack-surface monitoring to understand our potential vulnerabilities, threat vectors, and additional impacts to critical assets and operations. In addition, our cybersecurity team performs procedures to identify risks that inform our annual security roadmap.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Role of Management We have established a cross functional Cybersecurity Executive Steering Committee ("CESC") led by our Senior Vice President ("SVP") and Head of Technology Services, Chief Legal Officer, Chief Financial Officer and other executives from our Legal, Accounting, Cybersecurity and Facilities departments. The CESC meets at least quarterly and has primary management oversight responsibility for assessing and managing information security, data protection and privacy, and cybersecurity risks.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our board of directors and senior management. Assessment Processes: We conduct regular risk assessments to proactively identify potential cybersecurity threats and vulnerabilities. These assessments involve thorough evaluations of our IT infrastructure, data systems, and processes to pinpoint areas of weakness.

companyName: Venu Holding Corp

ticker: VENU


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on recognizing potential cybersecurity threats and implementing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings. We also conduct tabletop exercises for members of various functional areas on data recovery and incident response.

companyName: Cricut, Inc.

ticker: CRCT


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO") or a member of the IT Risk Management function.

companyName: Enova International, Inc.

ticker: ENVA


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: TAITRON COMPONENTS INC

ticker: TAIT


text: Company's risk management program includes governance through the cybersecurity committee, consisting of senior executive management team along with legal and other key holders. Our Enterprise Risk Management lead is tasked with integrating any cybersecurity risk considerations into overall risk management strategy. Risk management includes regular risk assessments to identify internal and external risks and to evaluate the magnitude of harm that could arise out of such risks. Further, risk management may utilize third party service providers where complementary and supplementary to the Company's overall business strategy. Lastly, risk management includes training and education over the continuously evolving landscape of cybersecurity threats. We engage external parties, including consultants, independent privacy assessors, computer security firms, training service providers and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we maintain cyber insurance coverage.

companyName: Aeries Technology, Inc.

ticker: AERT


text: The Company has an Incident Response Team ("IRT"), a cross-functional group with the expertise, authority and resources to act quickly, efficiently and appropriately to investigate, coordinate the response to, remediate, and communicate regarding a cybersecurity incident. The IRT uses a detailed incident response plan that outlines and coordinates the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. In addition, our IRT engages in tabletop exercises at least annually to simulate a response to a cybersecurity incident and uses the findings to improve our processes, plans and technologies.

companyName: HOME DEPOT, INC.

ticker: HD


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: We have designed and implemented a cybersecurity program which includes administrative, technical, and physical controls and processes to manage and mitigate material risks from internal and external cybersecurity threats, including but not limited to the following: A team responsible for designing, implementing, and continually improving our policies, procedures, and technology. A risk management process to identify, assess, and treat internal and external ( third-party) cybersecurity risks.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional information, see "Item 1A. Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems."

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; use of external service providers to assess, test or otherwise assist with aspects of our security controls; awareness training of our employees and senior management including consultation with third parties as deemed necessary;

companyName: Power REIT

ticker: PW


text: Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house information-technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: At the management level, our cybersecurity program is led by the CISO, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The CISO is informed about cybersecurity threats and incidents in accordance with the cybersecurity incident response plan as discussed above. The CISO, who reports to the CIO, regularly provides updates to the Chair of the Audit Committee and Chief Financial Officer. We also have protocols by which certain cybersecurity incidents are reported promptly to the Chair of the Audit Committee and Chief Financial Officer, as appropriate. The Company's CISO has served in various cybersecurity roles for over 20 years, leading a variety of cybersecurity and risk capabilities and also holds multiple cybersecurity certifications such as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified in Risk and Information Systems Control.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: Index to Financial Statements Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Our CISO has over 17 years of experience leading cybersecurity oversight for several companies and is updated on cyber events related to the monitoring, prevention, detection, mitigation, and remediation efforts from our IT security team. The IT security team have broad cybersecurity expertise or industry certifications and are knowledgeable in the use of cybersecurity tools and software. In addition, third-party cybersecurity services are used to augment our in-house capabilities, as needed.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: There have been no material cybersecurity incidents that have affected the Company for the period covered by this annual report. For a discussion regarding risks associated with cybersecurity threats, see Part I, Item 1A. Risk Factors – Business and Operations – "Our risk management policies, standards and procedures may prove to be ineffective and leave us exposed to unidentified or unanticipated risk, which could adversely affect our businesses, results of operations, financial condition and liquidity" and "We are exposed to certain risks if we are unable to maintain the availability of our critical technology systems and data and safeguard the confidentiality and integrity of our data, which could compromise our ability to conduct business and adversely affect our consolidated business, results of operations, financial condition and liquidity."

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Form 10-K.

companyName: RAMBUS INC

ticker: RMBS


text: Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate material vulnerabilities and the impact of cyber incidents.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential data, including, as appropriate, through review of vendor questionnaires and the inclusion of cybersecurity requirements in contracts.

companyName: Vigil Neuroscience, Inc.


text: Our CFO and the IT Manager report directly to the Risk and Information Security Committee to review the Company's information security and cybersecurity risks, including but not limited to, the MLPS report. Despite these efforts, no system is impenetrable, and we cannot provide assurances that we will prevent every attack or timely detect every incident.

companyName: FingerMotion, Inc.

ticker: FNGR


text: We have an enterprise risk committee that includes our executive leadership team and other senior members within our legal, IT, finance and accounting, and operational departments, which oversees BKV's operational, strategic, and corporate-level risks, including risk management.

companyName: BKV Corp

ticker: BKV


text: The Company maintains a cybersecurity program, with direct oversight from senior management and the Audit Committee (the "Audit Committee") of the Board of Directors (the "Board"), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's cybersecurity program has been developed in light of the nature of the Company's business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company's business to broadly implement its cybersecurity program.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Recognizing the complexity and evolving nature of cybersecurity threats, Wayfair engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Wayfair Inc.

ticker: W


text: Our Chief Information Officer and our Chief Information Security Officer meet regularly with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company's information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes. The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee. Further, our Audit Committee updates the full board on matters relating to cybersecurity risk management, as necessary.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: The Cybersecurity Department works with our strategic vendors, contractors, or other suppliers that provide services or technology products to complete information security risk assessments, each consisting of a holistic review using NIST as a standard. For these suppliers, operational security details, including third-party reports on compliance frameworks (such as NIST, SOC2 Type2), are reviewed by the Cybersecurity Department for sufficiency. The Cybersecurity Department uses tools to assist in monitoring cyber activities, benign and otherwise, and creates alerts based on anomalous activities or potential vulnerabilities. ACV personnel also are required to take cybersecurity training, which is designed to prepare our personnel to look out for and report any suspicious or anomalous events they may experience.

companyName: ACV Auctions Inc.

ticker: ACVA


text: As part of the Program, the Company has established policies and procedures to oversee, identify and mitigate material cybersecurity risks associated with the use of any third-party service providers. The Company evaluates and risk rates third-party relationships against a defined set of minimum-security requirements under its enterprise-wide Third-Party Risk Management program. Higher risk third party service providers are reviewed in more detail and as part of the continual due diligence process to ensure changes to the relationship and/or risk posture are identified and managed appropriately.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Access Control (RBAC): Access to sensitive systems is governed by users' roles, ensuring only authorized personnel can perform specific actions on critical systems with regular user access audits.

companyName: Health In Tech, Inc.

ticker: HIT


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establish policies and standards required to be implemented in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts, law enforcement, along with documentation of regulatory notification. Our practices are interdependent with service providers/vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Our Board of Directors (the "Board") is ultimately responsible for the risk oversight of the company, including, cybersecurity and privacy risks. Our Board has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee is composed of board members with diverse expertise enabling its members to oversee cybersecurity risks effectively. Our Audit Committee's responsibilities include reviewing the Company's cybersecurity and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: Bark, Inc.

ticker: BARK


text: As part of our overall enterprise risk management processes and to better evaluate our cybersecurity risks, we have conducted a business impact analysis by leveraging our annual company-wide enterprise risk management assessment to understand the relationship between our critical business operations and our information technology systems. We partner with a third party service provider to assist us on a real-time basis with detecting advanced threats, streamline and collaborate on investigations and recommend actions to further strengthen our systems and, if and when necessary, respond to incidents. In addition, we regularly engage independent third parties to test our cybersecurity processes and systems through consulting, independent audits and penetration testing. We also have a cyber risk insurance policy designed to help us mitigate risk exposure by offsetting costs involved with recovery and remediation after a cybersecurity breach or similar event.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: Our Board maintains oversight responsibility relating to our Program, with assistance from the Audit Committee. At least annually, our management team (including the leaders of our Information Technology and Internal Audit teams) provides an update regarding our Program to the Board. This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year. The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any significant cybersecurity incidents.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.

companyName: STRYKER CORP

ticker: SYK


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and employees ("Information Systems and Data").

companyName: IN8BIO, INC.

ticker: INAB


text: As of the date of this Report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us since our IPO.

companyName: Aldel Financial II Inc.

ticker: ALDF


text: We expend considerable resources on our cybersecurity management and oversight program designed to identify, manage, and mitigate cybersecurity risks. This program is integrated into our overall risk management systems and processes and includes continuous monitoring of cybersecurity threats, regular assessments of information systems, vulnerability management, penetration testing, employee training on cybersecurity best practices, and ongoing assessments of risk.

companyName: Science Applications International Corp

ticker: SAIC


text: The Nominating and Corporate Governance Committee (the " N&CG Committee ") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the N&CG Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISSO or IT manager, including updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.

companyName: DORIAN LPG LTD.

ticker: LPG


text: Management, including our Chief Information Officer, who has over 25 years of experience serving primarily in the life science industry and is a recognized industry leader, is responsible for monitoring and assessing cybersecurity risks. Management reviews and determines the effectiveness of both internal and third-party leveraged expertise to ensure we have the appropriate knowledge base for risk coverage.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: The Company has a Cyber Incident Response Team (the "IRT"), which is comprised of employees including, among others, the Executive Vice President of Information Technology, the Chief Financial Officer ("CFO"), the Chief Operations Officer ("COO") and the Chief Legal Officer ("CLO"), as well as potential outside advisors and service providers, as deemed appropriate. The Cybersecurity Plan contemplates that, in the case of a cybersecurity risk, Executive Vice President of Information Technology, in coordination with the IRT, will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, the Cybersecurity Plan contemplates that multidisciplinary teams throughout the Company will be deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Cybersecurity Plan dictates that the Executive Vice President of Information Technology and the IRT monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Cybersecurity Risk Management and Strategy Assessment, identification and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes to promote a company-wide culture of cybersecurity risk management. Our Chief Financial Officer is responsible for the evaluation of material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also regularly use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity consultants, as well as data backup and recovery providers.

companyName: Loop Industries, Inc.

ticker: LOOP


text: The ability to mitigate cybersecurity risks depends on an effective risk assessment process that identifies, measures, controls, and monitors material risks from cybersecurity threats. These threats include any potential unauthorized activities that could compromise the confidentiality, integrity, or availability of the Company's information systems and data. Our Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks, considering the Company's operations, inclusive of substantive changes to people, processes and technology. • Conducting internal and third-party security assessments, including penetration testing. • Overseeing third-party vendor risk through due diligence and monitoring.

companyName: BANNER CORP

ticker: BANR


text: The Company contracts with external firms to assess the Company's cybersecurity controls relative to its peers using the NIST CSF. The Company also has a third -party risk management program that assesses risks from vendors and suppliers. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: Cohen & Co Inc.

ticker: COHN


text: The Program is supported by a cross-functional team which identifies, assesses, monitors, tracks and pro-actively mitigates general and company specific risks, including those related to business continuity and third parties.

companyName: PERFICIENT INC


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information on cybersecurity risks and potential related impacts on us, see Part I, Item 1A. Risk Factors, "We rely on information technology and systems in our operations, and any material failure, inadequacy, interruption or security breach of that technology or those systems could materially harm our business."

companyName: RMR GROUP INC.

ticker: RMR


text: The Company's Chief Information Security Officer ("CISO") is primarily responsible for developing, monitoring, and implementing our Information Security Program (the "ISP") and coordinating with relevant parts of our business. Our program is organized around six key functions: (1) security operations and incident response, (2) security engineering and architecture, (3) threat and vulnerability management, (4) information technology/information security – governance, risk and controls, (5) security awareness and training, and (6) identity and access management.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: We expend significant capital to protect against cybersecurity threats, including denial of service attacks, email phishing schemes, hacking, advanced persistent threats, malware, and ransomware. Substantial additional expenditures may be required to respond to and remediate any problems caused by cybersecurity incidents, including the unauthorized access to or theft of patient data and protected health information stored in our information systems, the inoperability of our electronic clinical and business systems, and the infiltration or disruption of the information systems of our business vendors and partners. In the case of a material cybersecurity incident, the associated expenses and losses and lost revenue may exceed our current insurance coverage for such events. Some adverse consequences may not be insurable, such as reputational harm and third-party business interruption. For further discussion of the risks associated with cyber threats, see Item 1A, Risk Factors, "Other Operational Risks."

companyName: Encompass Health Corp

ticker: EHC


text: Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our CISO provides quarterly and as-needed briefings to the audit committee regarding cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third-party consultants. Our audit committee provides quarterly and as-needed updates to the board of directors on such reports and management provides annual and as-needed updates to the board of directors regarding our cybersecurity program.

companyName: Marqeta, Inc.

ticker: MQ


text: We conduct periodic tests to assess our processes and procedures and the threat landscape, which are designed with the goal of implementing and maintaining a robust cybersecurity program. Where appropriate, we take additional and ongoing steps intended to strengthen our cybersecurity capabilities and mitigate the risk of a breach or incident. Our security program and IT-related controls are regularly examined by internal auditors, external auditors and various regulators who regularly assess the design and effectiveness of our control framework. As part of those assessments, Asure maintains both SOC1 Type 2 and SOC2 Type 2 certifications specifically evaluating the security, confidentiality, and availability of its systems and information. Additionally, state examiners audit our IT-related controls as part of our Money Transmitter Licensing requirements.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board of Directors oversees management's processes for identifying, monitoring and addressing enterprise risks. In addition, the Audit Committee of the Board of Directors discusses with management the adequacy and effectiveness of the Company's policies and procedures regarding information technology risk management and internal controls related to cybersecurity.


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Information Technology department and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.

companyName: Velo3D, Inc.

ticker: VELO


text: We have policies and procedures designed to prevent, detect and respond to cybersecurity incidents or threats. We use industry standard security and monitoring systems that are managed by our internal information technology team with support from third-party IT services firms. We also periodically conduct internal and external security testing, such as phishing testing and penetration testing. The results of our security testing are reported to our chief technology officer and when relevant with the wider executive team.

companyName: COMPASS Pathways plc

ticker: CMPS


text: While, we have a comprehensive cybersecurity and compliance program in place as an effort to counter the threats, and while we have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition, there can be no guarantee that Crexendo will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our SVP has served in various roles in both engineering, operations, and information technology for over 20 years. He holds an undergraduate degree in mechanical engineering and a master's in business administration. Our VP of Information Technology has served in various roles in information technology and information security for 20 years. He holds an undergraduate degree in both industrial technology and distribution. Our Director of Information Security & Infrastructure has served in similar roles within information technology for over 25 years including risks arising from cybersecurity threats at several large publicly traded companies. He holds an undergraduate degree in criminal justice. Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity incidents and threats, at several large publicly traded companies.

companyName: PGT Innovations, Inc.


text: Our Chief Trust Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Trust Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: leading Autodesk's Trust program which implements data protection measures and processes across the organization; strategic planning of the company's cybersecurity initiatives and objectives; cybersecurity risk mitigation efforts; managing tools and processes that support security incident monitoring and alerting; overseeing security incident response planning; managing exercises that test management's response plans and procedures; and managing our response to suspected or actual security incidents.

companyName: Autodesk, Inc.

ticker: ADSK


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the headings "Failure of our information systems or those of third parties or breaches of data security could cause significant harm to our business" and "Cybersecurity breaches of our systems and information technology could adversely impact our ability to operate or meet contractual obligations," which should be read in conjunction with the information above.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: We have an established incident response plan that aligns with NIST guidelines, ensuring a structured approach to identifying, containing, eradicating, and recovering from security incidents. The plan includes defined escalation procedures to engage executive leadership and regulatory authorities as necessary. Our cybersecurity team conducts regular incident response exercises to enhance response readiness. Additionally, we have a process in place to perform post-incident reviews to refine processes and prevent recurrence.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: conduct quarterly business reviews of service providers including security operations performance and recommendations; and monitoring and auditing the service providers' performance, compliance, reporting and escalation procedures for any cybersecurity issues or incidents identified through quarterly business reviews.

companyName: AGREE REALTY CORP

ticker: ADC


text: As of the date of this report, the Company has not experienced any material cybersecurity events. However, the presence of new or more advanced forms of cybersecurity threats could have a material and adverse impact on the business, results of operations, and financial position. For further discussion relating to this topic, see Item 1A. Risk Factors "The Company's information technology systems may be negatively affected by cybersecurity threats. "

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Blackstone's CSO will report to the Board of Directors and/or Audit Committee periodically on cybersecurity matters, including risks facing BXPE and the Sponsor and, as applicable, certain incidents. In addition to such periodic reports, the Board of Directors and/or Audit Committee will receive periodic reports and/or updates from management on the primary cybersecurity risks facing BXPE and the Sponsor and the measures we and the Sponsor are taking to mitigate such risks. In addition to such reports, the Board of Directors and/or Audit Committee will receive updates from management regarding changes to BXPE's and the Sponsor's cybersecurity risk profile or certain newly identified risks.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Our Chief Information Officer ("CIO")/Chief Information Security Officer ("CISO") leads our cybersecurity program and reports to our Chief Executive Officer. The CIO/CISO stays informed of prevention, detection, mitigation, and remediation efforts through regular communication with professionals on our cybersecurity team, many of whom hold certifications such as Security+, Certified Information Systems Security Professional or Certified Information Security Manager. The CIO/CISO also utilizes technological tools, software, and third-party audits to monitor our cybersecurity efforts. Our CIO/CISO joined the Company in November 2018 and brings a wealth of experience from leading cybersecurity initiatives in previous roles. Our Chief Technology Officer ("CTO") joined the company in January 2023 following the Business Combination and previously served as Adtran Networks' CTO, leading their product management and advanced technology teams. Our CTO helps oversee our product security programs. Both the CIO/CISO and CTO have extensive experience in assessing and managing cybersecurity programs and risks. Our CIO/CISO reports to the Audit Committee and the Board of Directors on our cybersecurity program and efforts. Additionally, we have an escalation process in place to inform senior management and the Board of Directors of any material issues.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. We may also maintain cyber liability insurance that covers certain damages caused by cybersecurity incidents. However, there is no guarantee that adequate insurance will continue to be available at rates that we believe are reasonable or that the costs of responding to and recovering from a cybersecurity incident will be covered by insurance or recoverable in rates. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The IT/Cybersecurity Committee of the board of directors regularly reviews our cybersecurity program with management and reports to the Board of Directors. The IT/Cybersecurity Committee meets at least quarterly (or more frequently as may be required), and receives updates from the CISO on topics with respect to the cybersecurity program. The IT/Cybersecurity Committee reviews and approves our information security and technology strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The management IT/Cybersecurity and Risk Committees each provide reports of their activities to the full board of directors at each board meeting in the event all board members are not present at the relevant board committee meetings.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established procedures for the timely escalation and, when required, disclosure of cybersecurity incidents, supported by a formal incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident. While cybersecurity risks could materially affect the Company, past incidents have not materially affected our business strategy, results of operations or financial condition. For further details on potential cybersecurity risks, see Item 1A, Risk Factors — Risks Related to Cybersecurity, Data and Fraud.

companyName: BANNER CORP

ticker: BANR


text: Cybersecurity risk updates are provided quarterly to our senior management team by the CIO as part of our enterprise risk management process. We have established an incident response policy that outlines the process for assessing and responding to cybersecurity incidents. The incident response policy is reviewed at least annually by executive management. The Board also receives quarterly updates on cybersecurity risks. These reports are typically presented by our CIO to the Risk Committee of the Board and include updates to recently completed cybersecurity initiatives, upcoming plans, an overview of current threats, as well as discussion of our overall cybersecurity maturity and readiness. The Board participates in simulated cybersecurity trainings and is kept apprised of changes in cybersecurity regulatory requirements, ensuring that our organization remains in compliance with relevant standards.

companyName: DMC Global Inc.

ticker: BOOM


text: We have a global incident response process, managed by IBM's Computer Security Incident Response Team ("CSIRT"), that relies primarily on internal expertise to respond to cybersecurity threats and attacks. We utilize a combination of online training, educational tools, videos and other awareness initiatives to foster a culture of security awareness and responsibility among our workforce, including responsibility for reporting suspicious activity.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: The audit committee of our board of directors is responsible for overseeing the adequacy and effectiveness of the Company's information security policies and practices, as well as risks related to information security and cybersecurity. At least semiannually, and more frequently depending upon applicable facts and circumstances, our audit committee receives an overview of our cybersecurity threat risk management and strategy processes, which covers topics such as our incident response plan, results from third-party assessments, our cybersecurity risk roadmap and any threat risks, cybersecurity incidents or developments, and our progress towards risk-mitigation-related goals. The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee. Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses routine risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results. • Engagement of third-party service providers. The Company utilizes third-party cybersecurity experts to assess the Company's cybersecurity risks and conduct penetration testing to measure our cybersecurity risk management program relative to industry-standard frameworks. The Company has established a standardized process for assessing and managing potential risks associated with the engagement of third-party service providers that request access to the Company's information systems.

companyName: JABIL INC

ticker: JBL


text: From time to time, we engage third parties, including assessors, consultants, legal counsel, and others to conduct penetration testing, assess our program, provide recommendations for improvement, and advise us on best practices.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: In 2024, we encountered no cybersecurity threats that significantly influenced our operational, financial, or strategic outcomes. However, we acknowledge that our cybersecurity measures, while comprehensive, cannot completely eliminate the risk of cyber incidents or guarantee that all such incidents will be detected.

companyName: Crypto Co

ticker: CRCW


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Neuphoria will implement stringent processes to oversee and manage these risks. We will conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We maintain a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment or auditing for certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify, mitigating and manage cybersecurity risks associated with a particular provider.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: The Company has an Information Technology Governance, Risk, and Compliance function to address information technology risks, including cybersecurity risks. Additionally, a working committee of management meets periodically to review, assess, and manage material risks from cybersecurity threats.

companyName: DILLARD'S, INC.

ticker: DDS


text: Our cybersecurity policies, standards, processes, and practices are designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We have achieved ISO 27001 certification. Our cybersecurity program also includes a detailed control catalog that maps to several other frameworks, providing a broad approach to managing cyber risks. However, we use NIST and other cybersecurity frameworks solely as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: WORLD KINECT CORP

ticker: WKC


text: The IT risks and controls matrices are reviewed, authorized, and released annually by the Technology and Information Security Director. The matrices are then submitted to SCC's Internal Audit department to review and evaluate controls, in terms of design, implementation, and operational effectiveness.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations (CMOs). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: We maintain informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors and chief executive officer are responsible for monitoring and assessing strategic risk exposure, the day-to-day management of the material risks we face. Our board of directors and executive officer administer our cybersecurity risk oversight regarding third-party providers.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: To address cybersecurity, privacy, and overall business risk adequately, Astrana employs a consistent risk management process that assigns risks to functional owners. Risks can be strategic (e.g., loss of market share, technology shifts), reputational (e.g., loss of trust, revenue decline), regulatory (e.g., regulatory fines, business restrictions), or operational (e.g., operational downtime, productivity loss) in nature.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Corporation's cybersecurity program is managed by the Corporation's Vice President of IT, with support from cross-functional teams led by ExxonMobil information technology (IT) and operational technology (OT) cybersecurity operations managers (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.

companyName: EXXON MOBIL CORP

ticker: XOM


text: We have established a cybersecurity program, which we view as a foundational business practice incorporated into our broader risk management framework, as well as into all planning, development, operations and administration objectives. We have benchmarked our cybersecurity program against recognized frameworks established by the NIST, the International Organization for Standardization and other applicable industry standards.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: To assess the effectiveness of the Managing Owner's cybersecurity programs and to mitigate exposure, the Managing Owner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the Managing Owner's cyber insurance provider. The Managing Owner also undertook a table top exercise designed to identify and mitigate issues and train personnel.

companyName: GLOBAL MACRO TRUST


text: As part of our overall business strategy, we have acquired a number of companies for which our full cybersecurity standards may not be appropriate. These designated entities may deliver products and services using systems which are not fully integrated with our standard technology platforms or hosted in our data centers. We have established a separate set of Key Controls for designated entities appropriate to their size and operations that are designed around the same widely accepted international standards noted above, but tailored to the operational reality and business needs of these entities. Regular reporting of our acquired entities' cybersecurity program is provided to our Chief Information Security Officer (CISO), President of Technology, management committees and the board of directors. For additional information about our structural and organizational risks, see Item 1A of this report.

companyName: VISA INC.

ticker: V


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.

companyName: OFS Capital Corp

ticker: OFS


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and monitored using a number of leading practices and tools across physical and logical security. This security is also continually monitored by our information security department. We strictly regulate and limit all access to servers and networks at each of our facilities. Local network access is restricted by domain authentication, using stringent access control lists. Remote network access is restricted by a defense-in-depth approach that includes redundant firewalls, preventing unauthorized access from external networks to systems within our local network. We also employ (i) network and endpoint intrusion detection, intrusion prevention, and data loss prevention sensors throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our continuously staffed security operations center of potential cybersecurity issues, and (iii) a seasoned process for managing and installing patches for third-party applications.

companyName: Paycom Software, Inc.

ticker: PAYC


text: The Company devotes significant resources to helping protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company's cybersecurity risk management program includes physical, administrative, and technical safeguards. The Company's cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly. The Company is in the process of assessing its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the "Framework"). The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Senior Director, Information Protection & Compliance, who reports to our Chief Information Officer (CIO), to manage the risk assessment and mitigation process.

companyName: HAWAIIAN HOLDINGS INC


text: The Company has established an information security program and related processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company, including governance at the executive and Board level of the Company's cyber risk management strategy and the controls designed to protect its operations. The Company's information security program is established at the executive level, with regular reporting to, and oversight by, the Company's Board of Directors (the "Board") as described below. At the highest level, the Company's program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Our cybersecurity program is integrated with our overall risk management program through our Chief Information Security Officer's ("CISO") participation in governance structures such as the Risk Management Committee and Technology and Operational Risk Committee, and the incorporation of cybersecurity into the Company's overall compliance and enterprise risk management programs.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a disaster recovery plan; conducting risk assessments; maintaining network security controls; encrypting certain of our data; maintaining access and physical security controls; systems monitoring; assessing vendor risk; employee training; and maintaining cybersecurity insurance.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives. Under our comprehensive risk management program, the Board of Directors of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program. The full Board of Directors retains oversight over management's cybersecurity efforts. At least annually, and often more frequently, our Board of Directors receives cybersecurity briefings from senior executives, including, when appropriate, executives focused on cybersecurity matters.

companyName: ZW Data Action Technologies Inc.

ticker: CNET


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Accounting Officer.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: We rely on third-party service providers to perform a variety of functions throughout our business, such as contract manufacturing organizations, contract research organizations, suppliers and consultants. If we successfully obtain regulatory approval to commercialize imetelstat, we will rely on third party logistics organizations and distributors to distribute imetelstat. We conduct quality audits of regulated vendors, which typically include an assessment of such vendor's information technology systems, and we impose appropriate contractual obligations on vendors pertaining to information security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our efforts may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. We have not encountered cybersecurity challenges that have materially impaired our business, operations or financial standing.

companyName: GERON CORP

ticker: GERN


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives periodic briefings on, and discusses with our CISO, cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding certain significant or potentially material cybersecurity incidents that may occur, including any ongoing updates regarding the same.

companyName: PFIZER INC

ticker: PFE


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: Cricut, Inc.

ticker: CRCT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "The operation of Aspira Labs and our Aspira Synergy business depends on the effectiveness and availability of our information systems, including the information systems we use to provide services to our customers and to store employee data, and failures of these systems, including in connection with cyber-attacks, may materially limit our operations or have an adverse effect on our reputation."

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Allstate conducts risk and control assessments to proactively identify and assess the likelihood and impact of specific information security risks using the NIST CSF. The Company conducts these risk assessments at multiple levels of scope, including applications, business processes, business units, and enterprise. Allstate documents the identified risks, tracking them based on potential impact and the likelihood that harm might occur. The Company manages the risks in accordance with its Information Security Program.

companyName: ALLSTATE CORP

ticker: ALL


text: Board Oversight and Management's Role Enterprise Cybersecurity. Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Special Activities Committee of the Board supports the Board in oversight of classified business cybersecurity, including with respect to Company internal information and operational technology systems. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role.

companyName: RTX Corp

ticker: RTX


text: The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our processes for assessing, identifying, and managing cybersecurity threats are designed to be thorough and transparent, ensuring that investors have a clear understanding of our commitment to cybersecurity.

companyName: Powerfleet, Inc.

ticker: AIOT


text: While the company believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures the company is taking prove to be insufficient or if the company's proprietary data is otherwise not protected, see "Item 1A. Risk factors: Operational and other factors - Cybersecurity" in this report.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: Our Chief Financial Officer and Director of Information Technology, along with key executives, have roles in governance and facilitating alignment across our organization.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity program as necessary based on the information provided by these assessments, audits, and reviews.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: Our CISO provides periodic briefings to our Audit Committee regarding cybersecurity risks and activities, including recent cybersecurity incidents and related responses, cybersecurity systems testing, cybersecurity training efficacy, and cybersecurity risks. As necessary, our Audit Committee provides periodic updates to our Board of Directors on such reports. In addition, our CISO provides periodic briefings to the Board of Directors on cybersecurity risks and activities.

companyName: Samsara Inc.

ticker: IOT


text: As of the date of this report, we have not experienced any cybersecurity incidents that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," including the section titled, "If our security measures or information we collect and maintain are compromised or publicly exposed, customers may curtail or stop using our service, and we could be subject to claims, penalties, and fines.

companyName: Vynleads, Inc.

ticker: VYND


text: Due to nature of our business related to telecom, broadband, software development and cable services, respective operations have implemented internal policies that cover network security, IT infrastructure and software, physical access controls, data security, privacy policy required for operations.

companyName: GlobalTech Corp

ticker: GLTK


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: CN Healthy Food Tech Group Corp.

ticker: UCFI


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Audit Committee members also receive presentations on cybersecurity topics from our Vice President of Information Technology and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: SKYWEST INC

ticker: SKYW


text: Cybersecurity Governance: Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. The board of directors is responsible for the oversight of risks from cybersecurity threats.

companyName: Profound Medical Corp.

ticker: PROF


text: We also utilize a supply chain risk management process to assess cybersecurity risks associated with third-party software providers. We perform third-party risk assessments to both identify and mitigate risks from third parties such as vendors, suppliers, and others associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: DHI GROUP, INC.

ticker: DHX


text: Our CISO and our steering committee on information security, which includes members of our executive management as well as leaders of business functional areas, together with our Privacy and Data Protection Team, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CISO has over 20 years of experience leading in the information security field at well-known publicly traded technology companies. He also received a CIO Executive Education Certificate from Stanford University.


text: We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may experience delays or outages in our information technology systems and computer networks and the third-party information technology systems and computer networks that we use. We may be subject to breaches of our information technology systems, the third-party information technology systems that we use or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems or in the third-party information technology systems that we use and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our development programs and clinical trials (Information Systems and Data).

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: The audit committee receives regular reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them, including during audit committee meetings and other periodic updates. These reports are provided by members of the Company's management team responsible for such reporting, including the Cybersecurity Risk Management Committee. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Vera Therapeutics, Inc.

ticker: VERA