text: As of the date of the filing of this Form 10-K, we are not aware of attempts by third parties to gain access to our systems and networks and do not believe that any such attempts have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Our cybersecurity and data privacy programs are implemented and overseen by our Chief Information Security Officer ( CISO), our Senior Vice President (SVP) of Information Technology, and members of our executive management team.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX

secItem: Item 1C


text: Our CISO is responsible for the Company's information security program. In this role, the CISO manages the Company's information security Program.

companyName: FIRST BANCSHARES INC /MS/


text: Additionally, we engage third-party firms to conduct routine external and internal penetration testing of our information systems to emulate the common tactics and techniques of cyber threat actors, and we have developed processes to remediate identified vulnerabilities across a wide range of severities. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of certain third-party service providers. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include either cybersecurity-related contractual terms and/or periodic risk assessments throughout the life cycle of the third-party relationship. We maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to the remediation of cybersecurity incidents.

companyName: EPLUS INC

ticker: PLUS


text: We have not experienced a material cybersecurity breach, but risks from cybersecurity threats may impact our business strategy, results of operations, and financial condition.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: a Vulnerability Management Program that scans networks, devices, and information systems for known cyber vulnerabilities, and initiates processes to mitigate them;

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: Additionally, we maintain a third -party security program to assess, prioritize, and mitigate risks associated with our vendors and partners. We also rely on third parties to implement appropriate security measures.

companyName: Skillsoft Corp.

ticker: SKIL


text: 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are periodically evaluated. We utilize an established internal framework designed to assess promptly the severity and materiality of cybersecurity events and incidents based on various predefined quantitative and qualitative criteria, including the impact to potential personally identifiable information and/or patient health information, and to determine the appropriate level of response. Incidents are escalated based on their severity and materiality for prompt response and mitigation. This systematic approach involves preliminary investigations and detailed assessments to determine the severity and materiality of each incident, and there are established communication channels and engagement processes with those involved in this incident response process.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Global Technology Systems (GTS) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If any potential impact is determined to present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.

companyName: GLAUKOS Corp

ticker: GKOS


text: recruit and retain highly skilled cybersecurity professionals, and provide regular training and development opportunities for our cybersecurity and information security employees;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Our enterprise risk management program addresses risks facing Columbia from cybersecurity threats impacting our internal systems and/or systems supported by third-party software providers.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: To date, we do not believe that our business, results of operations and financial condition have been materially affected as a result of identified cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents that we are aware of. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information on our cybersecurity-related risks, please refer to the risk factor titled "We rely on our digital technology and applications and our business and operations could suffer in the event of information system failures or a cybersecurity incident" in Part I, Item 1A of this Report.

companyName: Evolus, Inc.

ticker: EOLS


text: Employee Training Programs We launch separate, annual web-based learning modules on cybersecurity, privacy and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and request that material third-party service providers provide us information about their security policies and procedures. We monitor cybersecurity incidents involving our third-party providers and adjust our procedures, as appropriate.

companyName: KADANT INC

ticker: KAI


text: The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with the Company's Chief Financial Officer to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: A cybersecurity operations team is in place to regularly monitor the environment for cybersecurity threats and incidents. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.

companyName: CUMMINS INC

ticker: CMI


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower employees with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Though we have previously experienced, and may experience in the future, cybersecurity incidents, we do not believe that any of these incidents have materially affected our business operations, financial condition or operating results. In the future, we may experience a material Cybersecurity Threat that could adversely affect our business operations, financial condition or operating results. For more information regarding our cybersecurity risks and the related potential impacts on our business, see the risk factor titled "Our failure to sufficiently secure our products and services may result in unauthorized access to customer data, a negative impact on our customer attraction and retention, and significant liabilities."

companyName: SMARTSHEET INC


text: Cybersecurity represents an important component of the Company's overall approach to enterprise risk management and is integrated into the risk management process and ongoing assessment. In addition to an internal security program, we strive to stay ahead of the threat landscape by working to conduct due diligence on key third-party vendors' Information Security programs and risks. We make strategic investments in our perimeter and internal defenses, cyber security operations center, and regulatory compliance activities with the advice of consultants and third parties. Moreover, to minimize risk, we maintain an insurance policy that provides coverage for matters relating to Information Security.

companyName: Vistra Corp.

ticker: VST


text: As part of the Company's Third Party Risk Management Program and in support of the CSP, reviews for cybersecurity, business continuity, fraud, and other policy-related topics are performed for the onboarding of new vendors and ongoing monitoring of existing vendors. Ratings assigned to a vendor determine review frequency and scope. Results are reported to key stakeholders and identified issues are tracked and monitored.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 25 years in Information Technology leadership including 15 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: We maintain programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, Cyber Risk Institute Profile, as well as various other regulatory requirements and industry-specific standards. The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the event of future attacks or other cyber incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco CurrencyShares Japanese Yen Trust

ticker: FXY


text: Oversight of information security risk and information technology risk is the responsibility of the Information Risk Committee, a management committee, with additional oversight from the Enterprise Risk Management Committee, a management committee, and the Risk and Technology Committees of the Board of Directors. On at least a quarterly basis, the Corporate Information Security team provides reports on updates to the Company's information risk profile, emerging risks and threats, results of examinations, status of remediation plans and/or results of remediation activities, risk reports and risk assessment results, and risk metric results to the Information Risk Committee, who then provides such information to the Enterprise Risk Management Committee and the Risk Committee of the Board of Directors. In addition, on at least a quarterly basis, this information, along with updates on key cybersecurity initiatives, is shared with the Technology Committee of the Board of Directors, who provides oversight on information security and information technology strategy and governance.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Company deploys technical safeguards designed to protect the Company's information systems, including firewalls and systems for anti-malware, intrusion detection and prevention. The technical safeguards are regularly evaluated, tested, and improved through vulnerability assessments and updated cybersecurity intelligence. The Company also maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and such plans are tested, evaluated and updated on a regular basis.

companyName: MANITOWOC CO INC

ticker: MTW


text: Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis by both management and the Board, including how such risks could materially affect our business strategy, operational results, and financial condition, and from time-to-time the Company engages third-parties to provide independent risk assessments.

companyName: CervoMed Inc.

ticker: CRVO


text: Our cybersecurity program also includes assessments of cybersecurity threats associated with our use of certain third-party service providers. JLL leverages pre-procurement security assessments and post-procurement continuous monitoring to evaluate the security risk of certain third-party service providers. We regularly engage third-parties to provide technology and/or to perform facilities management and project management services to our clients, where we have imperfect visibility into our third-parties' susceptibility to cybersecurity threats and/or their controls.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: The vice president and chief information officer, the vice president cybersecurity and the executive director cybersecurity are responsible for assessing and managing material risks from cybersecurity threats. They have careers that represent more than 50 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the executive vice president and chief risk officer, presidents and chief executive officers of FPL and NEER, the executive vice president, finance and chief financial officer and the executive vice president, chief legal, environmental & federal regulatory affairs officer, and the Cybersecurity Governance Executive Committee comprised of various members of management, including the vice president, internal audit and the executive director, emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.

companyName: FLORIDA POWER & LIGHT CO


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement. In addition to its other responsibilities, the HSE & Technical Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.

companyName: UR-ENERGY INC

ticker: URG


text: The Company implements current information technologies to support its cybersecurity practices. These technologies are designed to protect the Company's information systems from cybersecurity threats and include: email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management, backup and restoration processes, vulnerability and patch management, identity and access management and data encryption. These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third party specialists and certifications.

companyName: Xencor Inc

ticker: XNCR


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. The board of directors oversees management's implementation of our cybersecurity risk management program.

companyName: Cuentas Inc.

ticker: CUEN


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team itself performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG has informed us that it also conducts annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform its evaluation. This does not imply that TPG, its affiliates or we fully meet any particular industry standards, specifications, or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: We also are subject to legal and regulatory requirements that affect our response to cybersecurity-risk management, including the Sarbanes-Oxley Act, state data breach notification requirements and certain requirements under our leases with tenants.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item Governance

companyName: Solidion Technology Inc.

ticker: STI


text: Additionally, our cybersecurity risk management program incorporates a variety of tools and services to assess, identify, and manage material risks from cybersecurity threats, including regular network and endpoint monitoring, vulnerability assessments, and penetration testing.

companyName: SITIME Corp

ticker: SITM


text: CFO play a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies;

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks. Our Cybersecurity, Technology, and Biomedical Research ("CTBR") Committee is chaired by an independent director who is certified in Cybersecurity Oversight. The CTBR Committee receives briefings on our cybersecurity posture and cybersecurity trends and risks from management. Our CTBR Committee regularly briefs our Board of Directors on security posture, planned activities, and cybersecurity risks which may cause a material, adverse impact to the Company's operations, reputation, or value and will report any findings or make recommendations to the Board, as appropriate.

companyName: DLH Holdings Corp.

ticker: DLHC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program and is responsible for monitoring and assessing strategic risk exposure, while our management team is responsible for the day-to-day operations over the material risks we face. Our management team, including our Acting Chief Executive Officer and Chief Financial Officer and Senior Director, Information Security and Infrastructure, provide periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if applicable.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Under the oversight of the information security steering committee, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who engage in identifying, considering and assessing risks from cybersecurity threats and incidents on an ongoing basis; establishing processes to monitor such cybersecurity risks; putting in place mitigation and remediation measures; policy review and development; product support and deployment; and maintaining our cybersecurity measures. Our cybersecurity team also implements ongoing data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers. Cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan. Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.

companyName: Lucid Group, Inc.

ticker: LCID


text: The Board of Directors has delegated the oversight of cybersecurity risk to the Audit Committee. The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our CFO, regularly briefs the Audit Committee on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.

companyName: Manitex International, Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response tools; encryption of certain sensitive data and certain data on mobile systems; certain access controls enforcing the principle of need-to-know encryption of certain sensitive data and certain data on mobile systems; physical security measures; asset management, tracking and disposal; monitoring of certain systems; and employee training.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: The Board, through the Risk Committee, oversees the Company's processes for identifying and mitigating risks, including cybersecurity risks. Company management periodically briefs the Board on our cybersecurity and information security policies and plans, and the Board is apprised of cybersecurity incidents deemed to have a moderate or higher business impact. In the event of an incident, the Company has developed an incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: Quantum Computing Inc.

ticker: QUBT


text: Risks from Cybersecurity Incidents While we have experienced and will likely continue to experience varying degrees of cyber incidents in the normal conduct of our business, including attacks resulting from phishing emails and ransomware infections, those incidents have not materially affected the Company's business strategy, results of operations, or financial condition. There can be no assurance that the systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect future material consequences arising from incidents or attacks, or to avoid a material adverse impact on our systems after such incidents or attacks do occur. However, the Company does not currently anticipate that risks from cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Governance.

companyName: Cactus, Inc.

ticker: WHD


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, including but not limited to automated event-detection notifications or similar technologies which are monitored by our managed cybersecurity provider, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to our incident response plan follows the procedures set forth in the plan to investigate the potential incident, such as determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: W. P. Carey Inc.

ticker: WPC


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's information and cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security, including results of periodic security assessments performed in conjunction with ongoing monitoring. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.

companyName: AGILYSYS INC

ticker: AGYS


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: The Company has continued to invest in cybersecurity to evolve and improve its program and regularly assesses and measures itself against industry practices to identify opportunities to enhance training and awareness among our people and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents. When such improvements are identified and validated as appropriate in the Company's business context, they are incorporated in the roadmap for implementation.

companyName: FOSTER L B CO

ticker: FSTR


text: We believe our systems and processes with respect to the management of risks associated with cybersecurity threats are adequate. We have experienced, and may in the future experience, adverse impacts to our operations as a result of cybersecurity incidents. However, to date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see our risk factors, including our risk factor titled "If our internal enterprise IT networks, on which we conduct internal business and interface externally, our operational networks, through which we connect to customers, vendors and partners systems and provide services, or our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers, through which we research, develop and host products and services, are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted."

companyName: Fortinet, Inc.

ticker: FTNT


text: Our board of directors considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management efforts.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: We face numerous cybersecurity threats that range from cyber-attacks common to most industries to attacks from more advanced and persistent threat actors that target large information technology companies with products and services operating in strategic sectors. We could be adversely affected by cybersecurity incidents affecting our systems or the systems of our suppliers and other third-party service providers. To address these threats, we expend considerable resources on cybersecurity risk management, strategy, and governance.

companyName: Dell Technologies Inc.

ticker: DELL


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Board of Managers considers risks from cybersecurity threats in conducting its oversight of the Partnership's overall risk assessment, primarily through the activities of the Audit Committee of the Board of Managers. The Chief Financial Officer reports to the Audit Committee the results of the evaluation of risks from cybersecurity threats, the process, procedures and internal controls designed to address such risks, and other relevant information needed for the Audit Committee to operate its oversight responsibilities. The Partnership's internal audit function reports to the Audit Committee annually the results of its assessment of design and operating effectiveness testing of internal controls. In addition, the Audit Committee conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review assists in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework of the Partnership.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Testing and Assessments We conduct periodic reviews and tests of Company policies, processes, and standards designed to address cybersecurity risks and incidents. These efforts include annual vulnerability and penetration testing, audits, and other measures to identify and remediate cybersecurity gaps. The Company engages third parties to perform audits and assessments on our information security control environment and operational effectiveness, including information security maturity assessments. The results of such reviews, audits, and assessments are reported to the Audit Committee and senior management, and the Company makes adjustments to its cybersecurity policies, standards and processes as necessary based on this information. The Company also retains consultants and other advisors to assist in the development and maintenance of cybersecurity and data protection policies and procedures in compliance with applicable regulations and standards.

companyName: Telesis Bio Inc.


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors and the audit committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary.

companyName: PIXELWORKS, INC

ticker: PXLW


text: Cybersecurity risk is evaluated based upon risk-based approach. An analysis of information and technology assets that ranks the assets based upon their risk of potential internal and external threats and the impact of the potential loss of integrity, confidentiality, and availability of that asset is updated as appropriate. An Information Security Risk Assessment led by the Manager's Chief Information Officer ("CIO") is performed on an annual basis, and/or upon major changes of cybersecurity related processes and infrastructure, for evaluating the potential impacts to key technology, processes, and people upon known relevant threats. Either a mitigating action plan and/or risk acceptance with valid business reasons is required as a response to each identified risk. The results of the Information Security Risk Assessment are available to senior management for review and approval.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: The Board. The Chief Executive Officer, the Chief Financial Officer, other members of senior management and other personnel and advisors, as requested by the Board, report on our financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. The Board may request follow-up data and presentations to address any specific concerns or recommendations.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our cybersecurity program is overseen by our head of information technology, who has significant experience in the information technology space. Our information technology team is responsible for leading our cybersecurity strategy, policy, standards, architecture and processes. Such team is responsible for the identification and reporting of risks to our management and board, as described above. Our information technology team maintains a security operations center intended to identify anomalous activity. Further, our policies require all employees to notify our compliance, legal or information technology functions in the event of a cybersecurity incident.

companyName: Kiniksa Pharmaceuticals International, plc

ticker: KNSA


text: As part of the Board's oversight of risks from cybersecurity threats, the CISO leads an annual review and discussion with the full Board dedicated to Verizon's cybersecurity risks, threats and protections. The CISO provides a mid-year update to this annual review to the Audit Committee and, as warranted, additional updates throughout the year. The Audit Committee also receives a report from senior management on Verizon's cybersecurity posture and related matters at each of its other meetings during the year at which the CISO is not present.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. Our board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: We engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide annual independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for incident response, proactive threat identification services, security architecture consulting, security remediation services, patching and external audit services.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers. We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices. We utilize a Managed Detection and Response service that provides threat intelligence, technology, and specialist expertise to protect our systems and networks from cyber threats. We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: Our cybersecurity incident management plan includes the following, among other things: • The SVP-IT leads the team in the development, documentation, review and testing of security procedures, and incident response procedures. Beyond initial creation, procedures are continually re-assessed, augmented, updated, and tested on an ongoing basis; • The SVP-IT works with the Executive Team on the identification, assessment, verification, and classification of incidents to determine affected stakeholders and appropriate parties for contact; • The SVP-IT is responsible for launching the Cybersecurity Incident Response Team (CIRT) if necessary, and for notification to the Chief Executive Officer, who in turn will contact the Board of Directors and Government Security Committee in order to validate the response is being addressed appropriately. • The CIRT team, in consultation with outside experts if needed, is responsible for the following: o Initial containment; o Analysis to establish root cause of incidents, identification and evidence collection;

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee.

companyName: Toughbuilt Industries, Inc


text: While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.

companyName: Eaton Corp plc

ticker: ETN


text: Third-party assessments of the Company – We regularly engage third-party consultants, legal advisors and audit firms in evaluating and testing our risk management processes, compliance with international standards and regulations, and assessing potential cybersecurity threats, as appropriate. Any recommendations are tracked with senior IT ownership and timelines for remediation.

companyName: DONALDSON Co INC

ticker: DCI


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts to defend against them.

companyName: California BanCorp \ CA

ticker: BCAL


text: The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing cybersecurity risk management processes, including oversight and mitigation of risk from cybersecurity threats. The Nominating and Corporate Governance Committee receives reports, as necessary, from the Chief Financial Officer of the Company regarding cybersecurity threats or incidents.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and supply chain resources. We maintain a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by our engagement of third parties, including key vendors, service providers and other external users of our information systems, as well as the information systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Our vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and our review of the vendor's written security program, security assessments and other reports; (vi) provision from the vendor of a System and Organization Controls (SOC) 1 or SOC 2 report to evidence cybersecurity preparedness; and (vii) the imposition of contractual obligations on the vendor.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We, through our third party service provider that manages our information technology systems and networks, have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Role of Management Our management and information technology teams, collectively, have decades of experience in the areas of information technology, finance, legal, human resources, data privacy and risk management. Our internal information technology organization, overseen by our Chief Financial Officer (the "CFO"), is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The day-to-day activities of our information technology organization are managed by our current head of information technology director, who has more than 20 years of experience in information technology systems and cybersecurity, including experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure. The information technology organization also engages legal and cybersecurity professionals with appropriate subject matter expertise in support of its cybersecurity efforts. The information technology organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur.

companyName: Liquidia Corp

ticker: LQDA


text: Our cybersecurity risk management program is based on legal and regulatory requirements and considerations. Cybersecurity risks are included as an integral part of our broader Enterprise Risk Management ("ERM") program and reviewed quarterly by internal stakeholders comprised of cross-functional team to assess the risk level and strength of our mitigation strategies. Our cybersecurity risk assessment is performed regularly throughout the year, and may include: • Regular cybersecurity program, risk and incidents reporting to the Board of Directors; • Quarterly cybersecurity risk reporting to the Enterprise Risk Committee, which includes the Company's Chief Executive Officer, Chief Financial Officer, Senior Vice President, Legal, General Counsel & Secretary, Internal Audit, Chief Information Officer and CISO; and • Monthly Security Steering Committee meetings with members from the Company's cybersecurity, ERM, IT, internal audit and legal teams.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: As a cloud service provider, Sprout Social believes keeping data secure is important and takes steps designed to do so.

companyName: Sprout Social, Inc.

ticker: SPT


text: If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Director of Information Technology and CEO.

companyName: HARROW, INC.

ticker: HROW


text: William T. McLain, Jr., age 52, is Executive Vice President and Chief Financial Officer. Mr. McLain joined Eastman in 2000 and has served in high-level finance and accounting roles throughout the organization in the United States, Asia, and Europe. In 2011, Mr. McLain served as Director, Asia Pacific Finance, and in 2013 was appointed to International Controller. In 2014, Mr. McLain was appointed Corporate Controller until 2016 when he became Vice President of Finance. Prior to Eastman, Mr. McLain worked for the public accounting firm PricewaterhouseCoopers LLP. Mr. McLain was appointed to his current position effective February 2020.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The Audit Committee delegates day-to-day management of cybersecurity risks to the Company's senior management, which includes our CISO, who reports to the Company's CIO. Our CIO reports directly to the Chief Executive Officer. Our CISO leads a robust team of dedicated professionals that are responsible for a wide range of risk assessment and management and leads at least ten specialized teams of internal and external experts focusing on distinct categories of threats.


text: Third-Party technology risks that exceed Customers' tolerance level are escalated monthly within the Cybersecurity Risk Indicators Report. Customers' Directors' Risk Committee approves the CISO's mitigant decisioning, including prioritization and resource allocation. Customers has a formal budgeting process. Corporate Security expenses, solutions and staffing needs are subject to zero-based budgeting and additional needs are forecasted based on the previous year's metrics.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International's Professional Practices. Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises; cybersecurity exercises; protected backups for critical data; recovery time objectives; and recovery point objectives, including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: We assess our cybersecurity program against various frameworks. Our information security program is certified for compliance with the Payment Card Industry Data Security Standard for the safe handling and protection of credit card data. Annually, we are assessed, either internally or by an independent third party, against the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We also utilize reports prepared by our external partners to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies, and we regularly engage external resources regarding emerging threats. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including contractual mechanisms, as well as the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Public Storage

ticker: PSA


text: The CRO has a degree in Business Administration and Finance from the University of Montana. The CRO has over 24 years of combined experience with financial institution risk management, including prior experience as a bank regulator and a credit risk management consultant.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: (2) oversight of cybersecurity preparedness through information security reports, discussion of internal events and discussion of cybersecurity topics pertinent to the Company and the industry; (3) oversight of activities in support of the Company's business continuity/disaster recovery program to ensure optimal corporate resiliency in the unlikely event of a disaster; and (4) providing broad strategic guidance on the technology direction of the Company by, among other things, overseeing the development of the AmeriServ Strategic Technology Plan.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee ensures effective oversight by reviewing reports on information security and cybersecurity from the Director of Internal Audit at least annually.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: We have developed and implemented a comprehensive multi-layered cybersecurity risk management program, consisting of a dedicated cybersecurity function, risk assessments, policies and procedures managed by internal and external resources, that we believe is reasonably designed to prevent, detect and respond to cyber risks and incidents. We utilize a set of tools and services, including regular network, endpoint and cloud monitoring, vulnerability assessments, penetration testing, a Security Information and Event Management system, and tabletop exercises to identify and assess material risks from cybersecurity threats and to evaluate our cyber defense capabilities.

companyName: ENTERPRISE BANCORP INC /MA/


text: We recognize the critical importance of developing, implementing, and maintaining proactive cybersecurity measures to safeguard our information and operational systems and protect the confidentiality, integrity, and availability of our data. To that end, we engage in the following cybersecurity risk management principles:

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: To provide for the availability of critical data and systems, address regulatory compliance requirements, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake these activities: • undertake an annual review of our policies and statements related to cybersecurity; • conduct cybersecurity awareness training for all employees annually; • conduct privileged access and incident training for employees involved in our systems and processes that handle sensitive data; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable), require employees, as well as applicable third parties who provide services on our behalf, to treat customer information and data with care; • conduct tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the National Institute of Standards and Technology incident handling framework as the foundation of our incident response plan to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the certain potential losses arising from a cybersecurity incident.

companyName: Bakkt, Inc.

ticker: BKKT


text: To establish, implement, and evaluate our risk management policies and practices with respect to cybersecurity threats, and to facilitate the communication of such matters to the Board and to the TISOC, we have established a number of management committees, several of which include senior leaders and direct reports of the Company's President and CEO, that serve as our policymaking and management-level governing bodies with respect to our information security and data privacy programs; oversee the implementation of our information security and data privacy risk management strategy; and identify, consider, and escalate information security and data privacy issues that may arise in our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: The Company's information security efforts are led by our Chief Information Security Officer ("CISO"). The CISO meets at least quarterly with each of the Board of Directors, the EXCO, and the Senior Leadership Team ("SLT"), facilitating the Company's robust cybersecurity oversight and strategies that help us to assess, identify, and manage cybersecurity risks. This includes performing tabletop exercises at least annually with the Board, the EXCO and the SLT to evaluate our incident response processes and keeping them informed of the evolving threat landscape and how 1st Franklin is managing such risks.

companyName: 1st FRANKLIN FINANCIAL CORP


text: The Company engages in the regular evaluations of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including tabletop exercises and vulnerability testing, focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on certain of our cybersecurity measures, including audits and penetration testing. For example, we annually engage qualified third-party auditors to independently assess and attest to and/or provide certifications of compliance with the HIPAA Security and Privacy Rule, SOC2 Type 2, the Payment Card Industry Data Security Standard (PCI-DSS), UK CyberEssentials, and HITRUST. The results of such assessments, audits and reviews are presented to the Audit Committee and members of the Board, as appropriate, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on such assessments, audits and reviews.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: of evidence related to system modifications; and collaboration with external specialists to aid in the ongoing evaluation of existing policies addition, the Company has a strategic plan, which encompasses the following key elements: Establishment of a dedicated cybersecurity governance committee; of cybersecurity incident response procedures and formats; penetration tests on a quarterly basis; of segregation of duties to mitigate the risk of self-review of transactions within the system;

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: The CISO reports to management's Enterprise Risk Management Committee and quarterly to the Board's Risk Committee regarding the Company's cyber risks and threats, the status of efforts to strengthen information security systems, assessments of the Company's Cybersecurity Program, and the emerging threat landscape. In these meetings and on an ad hoc basis senior management receives periodic reporting from the Cybersecurity Department, Operations Department and Information Technology Department on operational risks and the steps taken to monitor and control cybersecurity exposure.

companyName: Bancorp, Inc.

ticker: TBBK


text: Our information technology team oversees the day-to-day management of our cybersecurity program with regular reporting to representatives of our Incident Response Team. Our information technology team has overall responsibility for our cybersecurity risk management program and procedures and reports regularly to the Audit Committee of our Board of Directors on cybersecurity matters. From a governance perspective, (i) we have an executive response team consisting of various senior executives, including our Chief Financial Officer, as well as members of our Incident Response Team (the "Executive Response Team") that oversees the recommendations, actions and responses of the Incident Response Team in connection with specific cybersecurity incidents, and (ii) the Audit Committee as well as our Chief Executive Officer are provided with updates from the Executive Response Team and the Incident Response Team regarding incidents as well as the policies, standards, processes and practices that we implement to address risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity matters that address a wide range of topics, including recent developments, evolving standards, vulnerability assessments and third-party reviews.

companyName: RH

ticker: RH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CIO. The CIO and the CFO are responsible for overall cybersecurity risk management strategy and communicating material cybersecurity priorities to the responsible board committee. The CIO has relevant cybersecurity expertise such as: leading the enterprise IT Security program for 7 years and Supply Chain Cybersecurity efforts for 6 years at a large commercial stage biopharmaceutical company. The CIO and CFO undertake efforts to learn about the Company's cybersecurity threats by reviewing security assessments and other security-related reports.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Both the board of directors and the Audit Committee periodically review the measures we have implemented to identify and mitigate cybersecurity risks. As part of such reviews, our board of directors and Audit Committee receive periodic reports and presentations from members of the team responsible for overseeing cybersecurity risk management. These periodic reviews address various topics including evolving regulatory standards, recent developments, vulnerability assessments, third-party reviews, and other information security topics that senior management deems necessary. We have also established protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the board of directors in a timely manner.

companyName: Compass Group Diversified Holdings LLC


text: The Audit Committee oversees our ERM program, which is designed to identify current and potential risks facing the Company and ensure that actions are taken as and when appropriate to manage and mitigate those risks. Cybersecurity risks are integrated into our ERM program, which includes an annual risk assessment, assignment of accountability for risk management and development of risk treatment strategies. We believe that evaluating cybersecurity risks alongside other business risks under our ERM program aligns our cybersecurity risk management strategy with the Company's broader business goals and objectives. The Audit Committee receives a comprehensive ERM report from management on a semiannual basis and discusses the results with the full Board. The Board also receives a comprehensive ERM report from management on an annual basis.

companyName: Wendy's Co

ticker: WEN


text: AFG has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity framework which provides a comprehensive method for developing a flexible, repeatable, performance-based and cost-effective approach to identifying and managing cybersecurity risks. The Company uses the framework to assess and improve its security posture.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to data security and privacy risks, and reviews information technology's program to monitor and assess data security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We contract with an independent cybersecurity provider to perform an annual cybersecurity risk and vulnerability assessment. We regularly test areas of potential vulnerability, utilizing penetration testing, ransomware-focused disaster recovery tests as well as testing exercises for other higher risk areas.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: We use service providers in an effort to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence service providers, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: The Company has developed an information security program for assessing, identifying and managing material risks from cybersecurity threats. The program includes policies and procedures that govern how the Company's security measures and controls are developed, implemented, and maintained. The Company conducts a cybersecurity risk assessment, based on a method and guidance from a recognized national standards organization, at least annually. The Company selects the security controls it uses to address cybersecurity risks based on its annual risk assessment, additional risk-based analysis performed by the Company and its evaluation of various factors, including the likelihood and severity of risk, the impact on the Company and others if a risk materializes, the feasibility and cost of controls, and the impact of controls on operations and others. Security controls used by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Antero Midstream Corp

ticker: AM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We reference various security industry frameworks and other guidance to help us assess, identify and manage cybersecurity risks. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants or other third parties from time to time to assist us with assessing and improving our cybersecurity program.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and are informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: We have a comprehensive and continuous cybersecurity training program for our employees, which aims to raise their awareness and knowledge of cybersecurity threats and challenges, and to enhance their skills and competencies in preventing and responding to the cybersecurity incidents. The program covers the Company's cybersecurity policies, guidelines, cybersecurity best practice guidelines, cybersecurity scenarios and simulations.

companyName: AGREE REALTY CORP

ticker: ADC


text: We are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through cybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity defenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against misuse, intrusions and cyberattacks and to protect the data we collect. Our processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into our overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. Our information security program maintains procedures and controls for the systems, applications and our data and data of our third-party providers. We have an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others and educate employees on mechanisms in place to report cybersecurity incidents or suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident response plan, which is managed by our C hief Information Security Officer (CISO) and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide platform that allows us to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: KIMBERLY-CLARK CORPORATION - 2023 Annual Report • oversight of third parties engaged to assist in our cybersecurity risk management, along with third parties' vendors; and • legal and regulatory compliance.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Our global chief information security officer (CISO), under the direction of our chief digital officer, leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks. Our CISO regularly updates the Board of Directors on cybersecurity risks as they relate to our information and operational technology systems, our suppliers, and other third-party service providers, in addition to updates on enterprise cybersecurity incidents and key Company defenses and mitigation strategies.

companyName: RTX Corp

ticker: RTX


text: Discovery. Occurs when a potential security incident is reported. Discovery can be initiated in several ways, including by customer support, employees, business partners, as a result of IT logging and monitoring, or in response to customer or vendor correspondence. Containment is the priority in the Discovery phase.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity, on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Each of our Markel Ventures businesses maintains its own, separate IT infrastructure, that often includes third-party providers, to support the needs of its business. As a result, cybersecurity risk for the Markel Ventures businesses is not concentrated in one system or service provider. Further, given the disparate nature of the businesses, systems, and providers, there is no single, uniform approach to managing cybersecurity risk at the Markel Ventures businesses – each is tailored to its unique needs. As is the case with all risks, management for each Markel Ventures business is responsible for evaluating and managing cybersecurity risks for its business. Therefore, each business determines the appropriate IT systems and providers needed to do so. Management for each business shares information on material risks from cybersecurity incidents with Markel Ventures management.

companyName: MARKEL GROUP INC.

ticker: MKL


text: We maintain an inter-departmental privacy and security committee that oversees our programs and initiatives that seek to protect and secure patient information as well as our data and information systems. This committee is responsible for, among other things, administering our incident response policies and procedures and various training and awareness programs that promote good system security practices by employees. This committee consists of our CSO, CIO, deputy CIO, chief privacy officer, and director of information security and compliance as well as in house attorneys responsible for cybersecurity and securities matters. It currently meets monthly and as warranted by privacy and security events.

companyName: Encompass Health Corp

ticker: EHC


text: Risk Management and Strategy Cybersecurity Risk Assessment and Management: The Sponsor has established a risk-based cybersecurity framework for the Funds to manage cybersecurity risks. This framework includes regular assessments of its information systems, physical and virtual infrastructure, and the data therein, to identify potential cybersecurity threats and vulnerabilities. This cybersecurity strategy is integrated into the Funds' overall risk management processes, with specific consideration given to the confidentiality, integrity, and availability of our information systems.

companyName: Amplify Commodity Trust

ticker: BDRY


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over ten years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2022 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: KKR FS Income Trust


text: Our corporate information security organization manages and continually enhances a robust enterprise security structure with the goal of averting cybersecurity incidents while increasing our system resilience to minimize the business impact should an incident occur. Led by our CISO, who reports to the Chief Technology Officer ("CTO"), our corporate information security organization is composed of seasoned professionals, some holding certifications such as Certified Information Systems Security Professional or Certified Information Security Manager. Our CTO has served in various leadership roles in information technology for over 20 years, including a nine-year tenure as the Chief Technology Officer at a fintech company. He holds a bachelor's degree in computer engineering and a master's degree in information systems. Our CISO, with over 20 years of leadership experience in IT and security, was a CISO at a financial services company before joining OppFi. She has an MBA and a master's degree in Computer Information Systems and is a Certified Information Security Manager (CISM). Additionally, both the CISO and CTO are members of the Information Security Council, providing regular updates to our senior management team regarding our cybersecurity program, mitigation strategy, and progress.

companyName: OppFi Inc.

ticker: OPFI


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.

companyName: SKECHERS USA INC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Director of Information Technology who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Arcellx, Inc.

ticker: ACLX


text: Integration into Overall Risk Management System or Processes The Cyber Risk Program is integrated into our overall risk management systems and processes. Our risk management systems and processes comprise numerous components, including published policies and procedures, risk detection systems, tools and protocols (automated and human); internal and external independent auditing; management committee review; defined lines of communications; employee training; engagement of outside advisors and experts; assessment and utilization of both commercial and self-insurance opportunities; client contract standardization where possible; legal review of vendor engagements and new products for regulatory compliance; and regular operations reviews with the Chief Executive Officer and Risk Committee. E2open utilizes the foregoing systems and processes to best ensure effective management of our risks and associated cybersecurity threats.

companyName: E2open Parent Holdings, Inc.


text: Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receive updates on cybersecurity and information technology matters and related risk exposures from our CISO and CTO as well as other members of the senior leadership team.

companyName: GAN Ltd


text: We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers. Our critical information technology includes certain computer networks, third-party hosted services, communications systems, software, personal computers and servers (collectively, "Information Technology"), and our critical data includes certain confidential, personal, proprietary and sensitive data (collectively "Confidential Data"). Accordingly, we maintain risk assessment processes designed to identify cybersecurity threats relating to such Information Technology and Confidential Data, and assess potential material impact to our business that may result from such threats. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our Information Technology and Confidential Data and mitigate material harm to our business.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: We maintain a range of tools and services to aid in and inform our monitoring and mitigation of cyber risks. Throughout the year, internal teams conduct targeted audits and penetration tests. We engage third parties to independently evaluate our cybersecurity maturity on an annual basis and perform a risk assessment, as well as to provide expertise as needed on various cybersecurity programs and issues. We maintain a security operations center that is staffed around the clock to detect, mitigate, and respond to cyber threats. In the event we identify a cybersecurity incident, we have defined procedures to respond to and recover from such incident as quickly as possible. Our policies and procedures are reviewed periodically to ensure they remain aligned with current regulatory requirements and the current threat landscape. We also have established classification and retention policies focused on limiting the risk of unauthorized exposure of customer, associate, and business data. We maintain cybersecurity insurance to help provide protection against losses arising from significant security incidents.

companyName: HOME DEPOT, INC.

ticker: HD


text: We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations or disclosures by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct periodic table-top exercises to simulate a response to a cybersecurity incident.

companyName: Gold.com, Inc.

ticker: GOLD


text: 1. Cybersecurity Risk Management The Company employs a structured cybersecurity risk management program that aligns with NIST CSF's five core functions: Identify, Protect, Detect, Respond, and Recover. The approach includes: • Risk Assessments: Regular evaluations of cyber risks across IT infrastructure, production systems, and cloud-based platforms. • Threat Detection and Monitoring: Deployment of Security Information and Event Management (SIEM) tools, intrusion detection systems, and endpoint security solutions to monitor cyber threats in real-time. • Third-Party Risk Management: Continuous evaluation of vendors and partners who have access to the Company's sensitive data and operational networks. • Access Controls and Encryption: Implementation of multi-factor authentication (MFA), data encryption protocols, and network segmentation to reduce attack vectors.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: The Board of Directors oversees CBIZ's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Board of Directors on the status of CBIZ's cyber risk management program, typically on a semi-annual basis.

companyName: CBIZ, Inc.

ticker: CBZ


text: We have not directly encountered any incidents from cybersecurity threats to date, but in November 2022, a breach was suffered by one of our vendors, which resulted in the release of certain information with respect to our patients and employees. This breach is discussed in more detail in Item 1. Business, under Regulatory Environment entitled "HIPAA and State Privacy and Breach Notification Rules". Based upon our investigation and the cooperation with our vendor, we believe the data breach did not have a material adverse effect on our business or result in any material damage to us and do not believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Although we have not yet been materially impacted by any cybersecurity incident, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "If we fail to properly maintain the integrity of our data or to strategically implement, upgrade or consolidate existing information systems, our reputation and business could be materially adversely affected" and "If our security systems are breached, we may face civil liability and public perception of our security measures could be diminished, either of which would negatively affect our ability to attract and retain patients".

companyName: JOINT Corp

ticker: JYNT


text: Considering the pervasive and increasing threat from cyberattacks, the board and the audit committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company to mitigate and prevent cyberattacks. The audit committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the audit committee or the full board regularly on their assessment of the Company's cybersecurity program and risks, including artificial intelligence. Both the audit committee and the full board receive regular reports from senior management on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Our board has risk management experience.

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: To deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. To mitigate cybersecurity risks and bolster our employee-based cybersecurity programs, we monitor all user traffic and restrict access by country. In addition, access to web sites is filtered and monitored, and credentials for systems and services require multi-factor authentication whenever possible.

companyName: Syros Pharmaceuticals, Inc.

ticker: SYRS


text: A breach of customers data could negatively materially affect our public trust and could result in loss of customers and revenue.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: Our sole director, who also serves as our Chief Executive Officer and Chief Financial Officer, has ultimate responsibility for cybersecurity oversight. This individual: Reviews our cybersecurity program and risk profile at least quarterly. Approves our cybersecurity policies, standards and incident response procedures; and Monitors management's implementation of recommended improvements.

companyName: ALEXANDER TECH CORP


text: implemented information security policies to monitor for and notify if personnel take potentially malicious actions against the company, such as forwarding sensitive emails or uploading data to non-approved cloud services; conducted recovery simulation of our proprietary database to determine restoration timing;

companyName: AGREE REALTY CORP

ticker: ADC


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: We periodically engage third -party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats to our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems has resulted in our current approach and these assessments are shared with our Audit Committee.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: To augment the Company's internal efforts, the Company engages third parties to conduct independent assessments of the Company's cybersecurity posture. These external assessments provide an objective review of the Company's security controls, breach readiness and compliance with industry standards and regulations. The insights gained from these audits inform refinements to the Company's risk management strategies with respect to cybersecurity-related threats.

companyName: EVgo Inc.

ticker: EVGO


text: The Board of Directors is actively involved in oversight of the Company's risk management framework and the Company's cybersecurity risk management practices are strategically integrated into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration attempts to ensure that cybersecurity considerations are an integral part of decision-making processes throughout the Company. The Company's risk management team works closely with the Company's IT department to continuously evaluate and address cybersecurity risks in alignment with the Company's overall business objectives and operational needs. The Company has implemented controls and procedures that are designed to provide for the prompt escalation of any cybersecurity concerns so that management, the Audit Committee, and the Board of Directors receive appropriate information in a timely manner.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Our risk management processes include a comprehensive enterprise risk management framework focused on (i) evaluating the risks facing the Company and aligning the Company's efforts to mitigate those risks with its strategy and risk appetite; (ii) communicating and improving the Company's understanding of its key risks and responsive actions; and (iii) providing the Board with a defined, rated risk inventory and framework against which the Board can direct its responsibilities to oversee the Company's risk assessment and risk management efforts. Our cybersecurity program is a key component of our overall enterprise risk management framework.

companyName: Public Storage

ticker: PSA


text: We have implemented a cybersecurity program in accordance with our risk profile and business size that is informed by recognized industry standards, including elements of the National Institute of Standards and Technology Cybersecurity Framework. We leverage the cybersecurity services of third-party vendors, including virtual chief information security officer services, to support our cybersecurity risk management program.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX