text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, or that are reasonably likely to affect us, including our business strategy, results of operations or financial condition.

companyName: POTBELLY CORP

ticker: PBPB


text: We manage third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third party risk assessment processes.

companyName: Marathon Petroleum Corp

ticker: MPC

secItem: Item 1C


text: Executive Leadership Our cybersecurity program is led by the Chief Information Security Officer ("CISO"), a Certified Information Systems Security Professional (CISSP) with over 25 years of experience in technology, cybersecurity strategy, risk management, and regulatory compliance, including extensive industry experience. The CISO works closely with the Company's executive leadership to implement and oversee the Company's cybersecurity initiatives. The CISO is also responsible for broader IT governance and risk management, resulting in a cohesive approach to protecting our technology infrastructure and sensitive data.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Deputy Chief Executive Officer and Chief Financial Officer reports to our board of directors, as well as our Chief Executive Officer and other members of senior management as appropriate.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: As part of our incident response planning, we also maintain cross-functional response teams involving personnel outside of our cybersecurity organization, both globally and regionally, in order to be prepared to respond to an incident.

companyName: WESTLAKE CORP

ticker: WLK


text: We regularly evaluate and assess the threat landscape and our security controls, including through audits and assessments, regular network and endpoint monitoring, vulnerability testing, penetration testing and tabletop exercises that include senior management. To assess the design and effectiveness of our cybersecurity controls, we engage with assessors, consultants, auditors and other third parties, including through independent third-party reviews of our information technology security program conducted on at least an annual basis. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence and contracting to manage cybersecurity risks in specified ways such as agreements to be subject to periodic cybersecurity audits.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. Security Program.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Our various corporate information technology, accounting and financial reporting platforms, enterprise applications and related systems (our "Information Systems") are necessary for our business. We use these systems, among others, to manage key aspects of our business, including relationships with our tenants and vendors, accounting, acquisitions, internal and external communications and property and asset management. We also rely on the secure collection, storage, transmission and processing of proprietary, confidential and sensitive data related to our business (our "Sensitive Data"). We utilize a third-party managed information technology service provider (the "MSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: In the event of a cybersecurity incident, we maintain a Cybersecurity Incident Response Plan. Pursuant to the plan and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We have a relationship with various law firms to assist with advisory on legal aspects of containing incidents and communicating accordingly.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: We require each third-party service provider who may have access to our systems and/or our sensitive data to confirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: The Company and the Board of Directors are committed to remaining updated on evolving cybersecurity regulations and best practices, as well as the development and amendment of processes to meet these changing demands. The Company did not experience any cybersecurity incident during 2024.

companyName: UNIVERSAL BIOSENSORS INC


text: We assess and identify security risk to the organization by: • conducting risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted; • performing penetration testing assessments annually and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer; • ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome; • continuously scanning for vulnerabilities and remediating vulnerabilities within their service level agreements in accordance with the associated risk level; and • reviewing third party and vendor risks to our organization through an internal interdisciplinary Technology Advisory Committee that includes members from our IT, Information Security Office (ISO), legal, compliance, clinical, finance and billing departments.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they are unable to resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events which are not routinely resolved by our IT and cybersecurity provider are brought to the attention of the board.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Under the oversight of our Board of Directors, we have implemented and maintain cybersecurity risk management policies and procedures that include processes for the identification, assessment and treatment through mitigation, transfer, avoidance and/or acceptance of cybersecurity risks.

companyName: WisdomTree, Inc.

ticker: WT


text: We recognize the critical importance in developing, implementing and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: Overseeing the assessment and management of our exposure to various risks, including cybersecurity, is a key oversight responsibility for the Board of Directors. We have an enterprise risk management (ERM) program that includes the processes used to identify, assess and manage our most significant enterprise risks and uncertainties that could materially impact the long-term health of the Company or prevent the achievement of strategic objectives. These risks are identified, measured, monitored and managed across key risk categories, which include the consideration of cybersecurity risks. Our chief financial officer (CFO) facilitates the Company's ERM program, which includes a formal assessment of the Company's risk environment at least once per year. The ERM program also facilitates the incorporation of risk assessment and evaluation into the strategic planning process and the provision of regular reports to senior management, including our CEO. The Audit Committee assists the Board with its oversight of both the ERM program and cybersecurity risk, providing regular reports to the Board. Our CFO reviews the ERM program with the Audit Committee at least once per year, including reviewing existing risks and significant emerging risks across the Company's key risk categories. In reviewing specific threats and risks with the Board, senior management may incorporate reports from consultants and other third-party advisors.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: The Head of Information Security oversees the Information Security team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Information Security and our Information Security team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Information Security, who has over 20 years of information technology experience, including over 10 years in leadership roles at First Solar, reports to the Chief Information Officer and regularly briefs the Chief Financial Officer and the audit committee of the board of directors on cybersecurity matters. The cybersecurity risks identified as part of our information security program are integrated into our enterprise risk management program. The audit committee reviews the integration of our cybersecurity controls and procedures with our overall risk management systems and processes, and reviews and discusses with management First Solar's major information security risks (including cybersecurity) and the steps management has taken to monitor, control, and limit such exposures and risks. An Information Security Steering Committee, which is comprised of senior management from various departments, serves in an advisory capacity regarding the implementation, support, and management of the information security program and compliance with applicable state and federal laws and regulations. This committee aligns business initiatives, material digital risks, risk tolerance levels, and security requirements with the information security roadmap.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in " Item 1A. Risk Factors " of this Annual Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our Board of Directors oversees risk for our Company, and prior to approving our filings with the SEC, our Board of Directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in " Item 1A. Risk Factors " of this Annual Report.

companyName: Valuence Merger Corp. I

ticker: VMCAF


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: Our CISO has held various Information Security Leadership and Technology roles over the past 25 years in the biopharmaceutical, life sciences industry, including roles at Genentech (USA), Roche Farma S.A. (Spain), Hoffman - La Roche (Switzerland) and most recently at Jazz Pharmaceuticals (USA) as their Global CISO before joining Recursion in 2021. Our CISO brings extensive risk management experience including developing cybersecurity strategy, implementing effective information and cybersecurity programs, and secure architecture.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: A dedicated Cybersecurity Council is responsible for Diversified's cybersecurity risk management and strategy. The Cybersecurity Council includes certain members of Diversified's Senior Leadership Team, including the Chief Operating Officer, Chief Financial Officer, Chief Information Officer and General Counsel. This Council meets at least once a quarter to discuss cybersecurity issues, risks and strategies. The Cybersecurity Council briefs Diversified's Board of Directors at least quarterly, on all security initiatives, including assessing risks, incidents and any remediation taken. Additionally, the Council is briefed on efforts to improve Diversified's network security systems and enhanced employee trainings. The membership of this council is adequately trained and educated to provide proper governance, risk management and control of the cybersecurity program utilizing the National Institute of Standards and Technology framework.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of our board of directors (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: AIRGAIN INC

ticker: AIRG


text: Our Chief Financial Officer, who reports directly to the Chief Executive Officer and has over 15 years of experience managing information technology and cybersecurity matters, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: Our CISO has more than 27 years of Information Technology and 21 years of Information Security experience in financial services including two other regional banks. He holds an undergraduate and master's degree in Cybersecurity and Information Assurance. Our CIO has 25 years of information technology experience and 18 years of experience in the financial services industry. Our CRO has more than 33 years of experience in Banking and over 15 years of experience in risk management, compliance, and BSA. Our COO is a seasoned bank operations executive with over 35 years of banking experience in Operations, Vendor Management, IT, Security, Treasury Management and Payment Operations.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Cybersecurity is recognized as a top enterprise risk and the IT Risk Management ("ITRM") program is an integral component of our enterprise risk management ("ERM") program. Protection of the Company's informational assets is managed by a comprehensive, multi-layer strategy, modeled on the National Institute of Standards and Technology ("NIST") cybersecurity framework, and combines technology, services, policies, and user education to mitigate cyber risks. We have instituted Acceptable Use, Information Security, and Vendor Risk policies and procedures, which support our efforts to protect employees and contractors, while ensuring that we partner with responsible vendors who also invest in effective cybersecurity practices. Where appropriate, we engage external experts in different capacities to assist in our assessment, identification, and management of risks from cybersecurity threats. Our relationships with these external partners enable us to leverage their expertise to continually strengthen our programs and procedures.

companyName: RADIUS RECYCLING, INC.


text: We also have a third-party risk management program in place to manage cybersecurity risks associated with third-party service providers. While we do maintain processes and procedures to identify, prioritize and assess risks associated with third-party service providers, we must rely on third parties to augment our security program, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: internal and external assessments, including audits and response simulations, to examine cybersecurity vulnerabilities and potential attack vectors to company systems, as well as evaluating the impact of these vulnerabilities in our operational and financial posture. processes to identify and manage risks related to critical third-party technology providers. a cybersecurity incident response plan that includes procedures for responding to cybersecurity threats or incidents.

companyName: AerSale Corp

ticker: ASLE


text: Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. In addition, we have secured cyber insurance coverage, and we plan to regularly review our coverage to align with the evolving nature of cyber threats and industry standards. For more information, see the section titled "Risk Factors— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our security, which could materially affect our results." in Part I, Item 1A. of this Annual Report on Form 10-K.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, as discussed under "Part I—Item 1A. Risk Factors," specifically the risks titled "Failures in, material damage to or interruptions in our information technology systems, software or websites, including as a result of cyber-attacks on our systems or systems operated by third parties that provide operational and technical services to us, costs associated with protecting the integrity and security of personal data and other sensitive information and difficulties in updating our existing software or developing or implementing new software could have a material adverse effect on our business or results of operations" and "Cyber-attacks could have a disruptive effect on our business," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: Our management team takes efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: To enhance the effectiveness of our cybersecurity program, we periodically engage external assessors, consultants, and auditors. These third-party service providers conduct independent evaluations of our cybersecurity measures, helping to identify areas for improvement and adherence to industry standards and best practices.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: We and our MSP identify, assess and manage material cybersecurity threats and risks to our Information Systems and Sensitive Data through the following, among others: • a multidisciplinary team, including a dedicated technology committee (the " Technology Committee ") comprising members from senior management, asset management and accounting and legal functions, in conjunction with our MSP and other third-party service vendors, to identify, assess and manage cybersecurity threats and risks; • various internal processes and procedures to monitor and evaluate threat environment and our risk profile using methods such as manual and automated tools, subscribing to reports and services that identify and analyze cybersecurity threats, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments; • various technical, physical and organizational processes and policies to manage and mitigate material cybersecurity risks, such as risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training and penetration testing; and • working with third-party vendors from time to time that assist us to identify, assess and manage cybersecurity risks, such as professional services firms and penetration testing firms. • The Governance Committee is responsible for cybersecurity oversight, we bring any threat to the committee as needed and they review our cybersecurity insurance, incidences, if any, and responses, if any, on an annual or as needed basis. • The Director of Operations, has provided oversight of technology efforts for the Company since 2021, and is responsible for notifying the Governance Committee upon receiving cybersecurity incidences immediately, via email.

companyName: GENERATION INCOME PROPERTIES, INC.

ticker: GIPR


text: We may face significant and persistent cybersecurity risks due to the need to protect our business, our confidential information and information concerning our personnel and others with whom we conduct business. As with other insurance brokerage companies, we occasionally face threats from actors who seek to disrupt our business as well as others who are engaging in malicious activities for profit, to make a political point or for no particular reason other than creating disruption. Disclosure of certain information as a result of a cybersecurity breach may result in a breach of privacy laws. The substantial level of harm that could occur to us and our business partners and customers were we to suffer impacts of a material cybersecurity incident; and our use of third-party products, services and components requires us to maintain robust governance and oversight of these risks and to implement mechanisms, technologies and processes designed to help us assess, identify, and eliminate these risks.

companyName: QDM International Inc.

ticker: QDMI


text: Our board of directors, in coordination with its T&IS Committee, oversees the governance of the Company's technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: IT staff are responsible for the daily management of our cybersecurity efforts. This includes updates and refinement of cybersecurity policies, execution and management of cybersecurity measures, and the preparation of regular reports on cybersecurity execution. Their primary focus is to consistently update our cybersecurity programs and mitigation strategies, ensuring they align with industry best practices and procedures.

companyName: AIRWA INC.

ticker: YYAI


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding risks we face, see Risk Factors - "Our internal computer systems, or those of third parties with which we interact, may fail or suffer security breaches, which could result in a material disruption of the development of our product candidates and research programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business," in Item 1A of this Annual Report on Form 10-K.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: The Company maintains cybersecurity prevention and response plans and procedures (the "Cybersecurity Policies") that set forth the Company's plan to prevent, manage, report and resolve cybersecurity events. The Cybersecurity Policies set forth the Company's policies and procedures for cybersecurity event prevention, including the Company's (i) network and computer systems acceptable use policy, (ii) data backup procedures, (iii) business continuity plan, (iii) data retention policy, (iv) disaster recovery plan, (v) email use and security policy, (vi) network change management procedures, and (vii) password and authentication requirements policy. The Cybersecurity Policies also (i) provide indicators that Company employees should be aware of to recognize a cybersecurity event, (ii) outline the roles and responsibilities for Company employees and other third parties with respect to the Company's cybersecurity incident response team ("CSIR Team"), (iii) set forth the steps to take in response to a cybersecurity incident, including reporting the incident, investigating the incident, preserving non-affected systems and data, informing, as appropriate, Senior Management (as defined below), insurance carriers, law enforcement and other parties that may be affected by the incident and (iv) maintaining business continuity.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: For the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."

companyName: SKYWEST INC

ticker: SKYW


text: Our CISO has over 25 years of experience leading global teams across a variety of IT disciplines as well as executive leadership of global Information Security / Cybersecurity organizations in complex, regulated environments. He holds an undergraduate degree in business administration from Appalachian State University.

companyName: NCR Atleos Corp

ticker: NATL


text: We have implemented a comprehensive Enterprise Risk Management ("ERM") process to identify, assess and manage risks related to our overall organization, including material risks from cybersecurity threats. Our ERM process takes a holistic view of our specific risks and our strategy to anticipate and manage possible risks. Our Executive Vice President, General Counsel and Chief Risk Officer ("CRO") oversees our ERM program and execution of our risk strategy, including as it relates to cyber risk. The Chief Information Security Officer ("CISO"), who reports to the General Counsel and CRO, leads our cyber risk management and strategy and the Information Security Department.

companyName: GLOBE LIFE INC.

ticker: GL


text: We operate in the biotechnology industry, where the protection of sensitive information and the continuity of our operations are critical. We are subject to cybersecurity risks which could adversely affect our business, financial condition, or results of operations. We maintain a risk-based cybersecurity program designed to identify, assess, and mitigate cybersecurity threats. Our program incorporates applicable industry standards and is managed through a cross-functional approach involving our Information Technology, legal, compliance, and other relevant teams. It is overseen by our Chief Information Officer ("CIO"), who is responsible for the day-to-day management of cybersecurity risks and the implementation of our information security program and incident response plans.

companyName: Pluri Inc.

ticker: PLUR


text: Our cybersecurity risks and associated mitigations are evaluated by our management and BDT & MSD as needed, but no less frequently than annually. The BDT & MSD CTO periodically reports to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of BDT & MSD's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.

companyName: MSD Investment Corp.


text: Our enterprise risk management committee ("ERMC") is composed of senior management, including the CIO and other senior executives. The ERMC monitors and oversees risk areas that potentially could pose a high impact to the business, and cybersecurity currently is one of the ERMC's priority focus areas. The ERMC reports on our top identified risks and steps to address those risks to the full Board on a semi-annual basis. Our CIO has over twenty years of information technology experience.

companyName: REPLIGEN CORP

ticker: RGEN


text: As of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor included in the section entitled "Item 1A. Risk Factors" in this Report.

companyName: RYVYL Inc.

ticker: RVYL


text: Engage Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Hilltop engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements. In particular, each year we engage a firm to perform penetration testing. We do not allow the same firm to be engaged for more than three years in an effort to obtain diversity in methods of testing. Additionally, at least every two years, we engage a firm to perform a red-team exercise for a simulated cybersecurity event.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms for effective governance in managing risks associated with cybersecurity threats, because they recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: HUNTSMAN INTERNATIONAL LLC


text: Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system. These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology. We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services. These security capabilities are designed to mitigate vulnerabilities and the impact of cyber incidents.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors or an officer appointed by our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: ATLANTIC INTERNATIONAL CORP.

ticker: ATLN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Our third party Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. Our management team, including our Chief Executive Officer and Chief Financial Officer, evaluates cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: Board of Directors' Roles and Responsibilities Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are evaluated by senior leadership. These risks and mitigations are also subject to oversight by the Audit Committee and the ROC of our Board of Directors The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters. The ROC oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks. The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis. The ROC also oversees the Board's response to any significant cybersecurity incidents.

companyName: Science Applications International Corp

ticker: SAIC


text: Our CISO has extensive cybersecurity experience, maintains multiple professional certifications and has served in various roles in information technology and information security for over 25 years.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan. Containment procedures may include off-lining systems, including by disconnecting network cable, utilizing network-management tools to isolate the host, altering the DNS entry of impact hosts, and coordinating with service providers.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: As of the date of this report, the Company has not experienced any material cybersecurity events. However, the presence of new or more advanced forms of cybersecurity threats could have a material and adverse impact on the business, results of operations, and financial position.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: We have experienced cybersecurity incidents in the ordinary course of business and will continue to experience risks from cybersecurity threats that could have a material adverse effect on our business strategy, results of operations, or financial condition. Although prior cybersecurity incidents have not had a material adverse effect on our business strategy, results of operations, or financial condition to date, any actual or perceived breach of our security could damage our reputation, adversely affect our operations, or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of sales." and "A failure of our information technology systems, or an interruption in their operation due to internal or external factors including cyber-attacks, could have a material adverse effect on our business, financial condition or results of operations." in Item 1A "Risk Factors" of this Annual Report.

companyName: Outdoor Holding Co

ticker: POWW


text: The Company has implemented various technical, physical and administrative security controls to account for these and other cybersecurity threats. For example, we have implemented technical security controls focused on ensuring the security and protection of computer systems and networks; all pertinent domestic operating entities of the Company are required to adhere to a standardized "Company Confidentiality System," which is centrally overseen and enforced, subject to oversight by our management and board of directors. This Company Confidentiality System includes specific provisions for information pertaining to network security, data security, and information that, if compromised, could have detrimental effects on the public interest and the Company. The Company and its employees are also required to sign confidentiality agreements for purposes including helping to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.

companyName: Vaxart, Inc.

ticker: VXRT


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence or a series of related unauthorized occurrences, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk advisory services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, the emerging threat landscape, and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect and mitigate cybersecurity incidents. In addition, the Audit Committee is responsible for reporting information about such risks to the Board of Directors and material cybersecurity risks and/or events are reviewed by the Board of Directors, at least annually, as part of the our corporate risk oversight processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity risk management processes are led by our VP, IT Business Solutions who has over 23 years of experience in various roles involving managing information systems and cybersecurity functions and developing cybersecurity strategies. Through these roles the VP, IT Business Solutions has implemented information technology security and privacy policies across multiple infrastructure and application platforms as well as identity and access management enhancements. In order to enable the Company to prevent, detect, mitigate and remediate cybersecurity incidents, our security monitoring and protection systems are continuously monitored. The VP, IT Business Solutions is kept informed in accordance with our Incident Response Plan and reports matters to the Audit Review Committee as necessary. Additionally, we have a Cyber Security Task Force in place to support our VP, IT Business Solutions that is comprised of individuals across our various departments within our organization including information systems, legal, finance, internal audit, sales and marketing, engineering and supply chain teams which meets regularly to further advance our cybersecurity strategy.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: Our Board of Directors, including the Audit Committee, is briefed on our Manager's information security program and cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually to our Board of Directors, including the Audit Committee, and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: As part of our efforts to identify, assess, and manage material risks from cybersecurity threats, we engage third-party cybersecurity consultants and use them to, among other things, conduct a review of our cybersecurity program or conduct a tabletop exercise to help identify areas for continued focus, improvement and/or compliance.

companyName: Sunrun Inc.

ticker: RUN


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyber attacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Our cybersecurity management governance structure is led by a CISO (reporting into the Chief Information Officer) with the support of an established Information Security ("InfoSec") function that is responsible for maintaining and monitoring ADT's cybersecurity infrastructure. ADT also has a Data Privacy Officer (reporting into the Chief Legal Officer) whose role is to ensure ADT's processes and protections over sensitive data comply with applicable data protection rules and regulations. In addition to the activities described above under "Risk Management and Strategy," we have a cybersecurity council (composed of ADT management with expertise in IT security, compliance, and communications) that meets quarterly to review and discuss compliance, cybersecurity risk, and preventive programs.

companyName: ADT Inc.

ticker: ADT


text: The Company maintains an incident response plan that is designed to quickly respond to cyber security related incidents in a manner that protects its own information and the information of the Company's customers and tenants as outlined in the incident response plan. The incident response plan establishes a primary incident coordinator, incident response teams, workstreams, escalation paths, and contacts to be engaged in an incident. The Company conducts scheduled tests of its incident response plan to verify that the teams understand how to respond to cyber threat scenarios.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, the ITSC and Chief Information Officer provide reports and updates to the Board of Directors, or a Committee thereof on a quarterly basis.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: The Company's risk assessment and mitigation program is centered on the following components: • Identification of significant risks (primarily through enterprise risk assessments); • An evaluation of the likelihood of such risk occurring, the potential impact and the control strength, consideration for compensating controls to mitigate the risk; • Prioritization of different risk items based on, among other things, the results of our evaluation; and • Establishment of a process for addressing those risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: Cybersecurity is a critical aspect of our business. As the world's largest independent omni-channel sell-side advertising platform, we face a multitude of cybersecurity threats, and our customers rely on us to safeguard their data. These challenges make it imperative that we take information security seriously, and we expend considerable resources on cybersecurity. We have implemented a comprehensive cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: MAGNITE, INC.

ticker: MGNI


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management is implementing security awareness training which will be conducted annually for staff with a high failure rate on the phishing tests.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees; • a global incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and suppliers.

companyName: Callaway Golf Co

ticker: CALY


text: Our Adviser has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: As of December 31, 2023, we have experienced a few outages which we do not believe impacted the integrity of our data. While we continue to make investments to improve the protection of data and information technology, there can be no assurance that our efforts will prevent service interruptions or security breaches. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Data Privacy and Cybersecurity" included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Cyber team members participate in industry forums to collaborate and keep current on emerging risks and new technologies. We also strive to maintain key relationships with relevant government agencies for the purpose of collaborating on matters of cybersecurity.

companyName: Warner Music Group Corp.

ticker: WMG


text: Under our "Cloud First, Cloud Now" strategy, we prioritize usage of cloud-based technologies to foster innovation, enhance customer service, and meet the demands of the evolving logistics landscape. Cybersecurity is integrated into this strategy through investments in technology and skill development to help protect the confidentiality, integrity, and availability of our systems and electronic data. During the period covered by this Form 10-K and through the date of its filing, we have not experienced, to our knowledge, an information security breach or identified cybersecurity threat risks that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize that cybersecurity threats are continually evolving, as further addressed in Item 1A of Part I of this Form 10-K.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: Our cybersecurity team is headed by our Senior Director of Cybersecurity, who has over 15 years of experience with IT and cybersecurity. The cybersecurity team reports to our Senior Vice President-Information Technology. The Senior Director of Cybersecurity and the Senior Vice President-Information Technology are part of, and work with, a management Cybersecurity Steering Committee ("CSC"), which meets regularly. The CSC works to ensure strategic alignment of the CSP with our business objectives and priorities. The CSC is chaired by the Senior Director of Cybersecurity and is composed of our Chief Financial Officer, Chief Operating Officer, General Counsel and senior members of our finance, legal, IT, risk management and internal audit teams. The Company has designated an incident response team and defined criteria to guide responses to cybersecurity incidents.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: The Audit Committee is responsible for, and actively engaged in, the oversight of our IT and cybersecurity program, including the oversight of risks from cybersecurity threats. All members of the Audit Committee have prior work experience relating to cybersecurity or have obtained a certification or degree in cybersecurity. The Audit Committee, at least quarterly, receives reports from the Company's Senior Director – Information Technology ("SDIT") on, among other things, the Company's cybersecurity incidents, risks and measures, training and organizational readiness. The board of directors is kept apprised of cybersecurity risk matters, including through participation in the quarterly cybersecurity briefings to the Audit Committee that are described above. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the board of directors and Audit Committee.

companyName: Valaris Ltd

ticker: VAL


text: We have engaged a third party consulting firm, VeraSafe, as our DPO. The DPO is responsible for ensuring that we have a Personal Data Protection program in place that is compliant with data privacy laws such as the EU GDPR, UK GDPR, China's PIPL, and data privacy laws enacted at the state level, as applicable to us. Our corporate Personal Data Protection program includes policies, practices, and training directed to protecting personal data.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Our CISO leads management's efforts to assess and manage cybersecurity risks through execution and enforcement of the Program, implementation of the ISP, reporting cybersecurity risks to senior managers of the Company, and meeting at least twice annually with the Board to discuss cybersecurity risks. The CISO works closely with the CTO, the Company's Executive Committee and other senior managers, including through his participation in the Operational Risk Committee and the CIRT. In addition to the processes described above, our CISO leads a team of information security specialists with which he holds dedicated cybersecurity meetings and regularly reviews key cybersecurity metrics. The information security team monitors public cybersecurity threats and meets with external experts periodically to review these threats and to stay abreast of the evolving threat landscape. Our CISO brings over 25 years of experience in the field of cybersecurity and technology infrastructure having held similar roles at leading global asset managers and investment banks. He has a broad technical background in information security strategy, risk management, and enterprise system design.

companyName: PJT Partners Inc.

ticker: PJT


text: Our Board of Directors executes its cybersecurity risk oversight function as a whole and by delegating responsibility to the Technology and Cybersecurity Committee of our Board of Directors, which oversees our management of risks relating to information technology security and our cybersecurity policies, controls and procedures. The Audit and Finance Committee of our Board of Directors oversees our enterprise risk management program as a whole and risk management regarding major financial risk exposure, including the potential financial impact of cybersecurity incidents. The Technology and Cybersecurity Committee receives quarterly presentations and reports on cybersecurity and information security risks from management, including our Executive Vice President and Chief Information Officer ("CIO") and Vice President, Chief Information Security Officer ("CISO"). These presentations and reports address a broad range of topics, including progress of security initiatives, strategy, key performance indicators, cybersecurity risks, and notable cybersecurity incidents. In addition, the Technology and Cybersecurity Committee and the Board of Directors receive briefings from time to time from outside experts for an independent view on cybersecurity risks, including best practices and current trends in cybersecurity.

companyName: Performance Food Group Co

ticker: PFGC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Technology Officer ("CTO"), James Liao, to manage the risk assessment and mitigation process.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. The Information Technology organization, led by the CIO, is responsible for the implementation of cybersecurity technical controls. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Network Defense Architect, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: The Information Security organization is led by our CISO. The head of each of the four divisions of our Information Security team reports directly to the CISO. The CISO reports directly to the Company's Chief Information Officer and Head of IT ("CIO"), who is a member of the Company's Senior Management Committee. As a result, all information security personnel report into the CISO, and ultimately the CIO. The CISO also reports indirectly to the Audit Committee of the Board of Directors. Biannually, the CISO reports to the Audit Committee on the cybersecurity risks facing the Company and cybersecurity developments generally. In addition, as discussed above, the Company's Internal Audit team reports to the Audit Committee the results of its annual security audit focused on cybersecurity risks. The Company's Chief Compliance Officer reports key Privacy risk indicators and statistics (including those related to cybersecurity risks) to the Audit Committee on a quarterly basis.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: In performing his role, our CISO regularly performs the following: review of enterprise cybersecurity risks, controls, program policy, processes, and training; oversight of policy and program development, implementation, and updates; and information to senior leadership about cybersecurity-related issues and activities affecting the organization. Our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs, and lifecycle status. He possesses a deep understanding of evolving cybersecurity threats, technologies, and industry best practices to identify cybersecurity risks and threats and assess and guide mitigation strategies effectively. Relevant cyber certifications include Certified Information Systems Security Professional and Certified Information Security Manager.

companyName: Invitation Homes Inc.

ticker: INVH


text: Despite being a small organization, we are committed to maintaining governance and oversight of these risks and to implementing standard operating procedures ("SOPs") and training to help us assess, identify, monitor and respond to these risks. Employees are trained to avoid phishing emails, and our internal controls system is designed to mitigate the risk of payments of fraudulent invoices.

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: Our Director of Security has extensive experience implementing and managing cybersecurity policies, including overseeing investments in tools, resources, and processes that enables the continued maturity of our cybersecurity program. Team members supporting our information security program possess relevant educational backgrounds and industry experience. Our CEO, Chief Financial Officer, and Audit Committee receive regular reports from our Director of Security on the Company's risk and compliance with cybersecurity matters, including data privacy, incidents, industry trends, and the prevention, detection, mitigation, and remediation of cyber incidents.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: Board Governance and Management Our Board is actively engaged in monitoring the performance of the Company's cybersecurity program and maintains oversight of the Company's enterprise risk program, including with respect to commodity markets, market design, enterprise security (physical and cyber), operating risks, and financial performance. While the full Board retains ultimate responsibility and oversight of the Company's cybersecurity risk management practices, the Nuclear Oversight Committee and the Audit and Risk Committee also have cybersecurity risk management as part of their charters. The Nuclear Oversight Committee is tasked with overseeing compliance with policies and procedures to manage and mitigate cybersecurity risks associated with our nuclear assets. The Audit and Risk Committee oversees policies and processes established by management to identify, assess, monitor, manage and control technology and cyber risks, among other risks. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) provide regular reports to the Board, or one or both of its designated Committees, regarding the security of our operational and information technology programs, systems, and risks. We also report on the state of our cybersecurity program and provide key risk indicators to track performance. Emergent matters or events are reported to the Board between scheduled meetings on an ad hoc basis through our incident response and crisis management protocols.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CLCO, our COO, and our IT personnel. In their time with our company, our CLCO and our COO have become increasingly involved in investigating, responding to, and mitigating cybersecurity incidents and intrusion attempts. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CLCO and our COO oversee our governance programs, test our compliance with standards, remediate known risks, and oversee or lead our employee training program.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a managed services provider ("MSP"), which provides wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity training.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company has implemented or is in the process of continuously evaluating, testing and updating various information security processes, policies and protective technologies designed to identify, assess and manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Company's residents' and employees' personal data.

companyName: Veris Residential, L.P.


text: Risk Management and Strategy NewtekOne maintains a Risk Management framework to identify, measure, mitigate, monitor and report material risks to the Risk Committee of our Board. Our Risk Management process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Chief Risk Officer who reports to the Risk Committee and our CEO. The Risk Committee sets the risk appetite across NewtekOne while the executive leadership team and our associates identify and monitor current and emerging risks and manage those risks within our risk appetite. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.

companyName: NewtekOne, Inc.

ticker: NEWT


text: The program is managed by the CISO who reports to the Chief Operations Officer and is reviewed by regulators as well as internal auditors. The Chief Information Officer ("CIO") and information technology staff support the CISO in cybersecurity operations as necessary to mitigate risks to the Company's technology infrastructure. The CISO holds two cybersecurity industry leading certifications (CISSP, CCSP) and has more than 20 years of technology experience. Information technology staff are generally subject to professional education, experience, and certification requirements, and receive education and mentoring from the CISO and CIO.

companyName: Investar Holding Corp

ticker: ISTR


text: As part of management's oversight of our cybersecurity program, we also maintain an executive-level cybersecurity steering committee, comprised of Hologic's Chief Financial Officer, General Counsel, Head of Internal Audit, Chief Information Officer, Head of Human Resources, Head of Global Supply Chain, and Division President of Breast and Skeletal Health, to help address cybersecurity risks at an enterprise level. The cybersecurity steering committee is a decision-making body that coordinates and communicates the direction, current state, and oversight of our cybersecurity and risk management programs.

companyName: HOLOGIC INC

ticker: HOLX


text: We have established an enterprise risk management program, with cybersecurity representing a relevant component of our overall approach to risk management. The cybersecurity portion of our risk management program shares common methodologies, reporting channels and governance processes that apply across the program to other legal, compliance, strategic, operational, and financial risk areas. In general, we seek to address cybersecurity risks through a data security framework that is focused on information classification and location, access and acceptable use controls, alerts and protections, vendor risk assessment, and backup and recovery. We engage third parties to perform assessments of our cybersecurity measures, including tabletop exercises, penetration testing, and other cybersecurity audits. As part of our cybersecurity risk management procedures, we also have a third-party cyber risk management process for service providers, suppliers, and vendors. Additionally, we provide regular, mandatory training for all employees regarding cybersecurity threats.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of AGBA's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter.

companyName: Triller Group Inc.

ticker: ILLR


text: As part of our ISP, we also perform cyber risk assessments on our third party vendors where we deem appropriate based on our risk assessment of such vendors, then periodically thereafter.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: Commencing in 2024, our Nominating and Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.

companyName: MERRIMACK PHARMACEUTICALS INC


text: • Risk assessments and mitigation strategies Conduct regular risk assessments to identify and prioritize critical assets and vulnerabilities, both internally and with respect to third-party risks. Develop and implement appropriate mitigation strategies based on risk assessments. Monitor and evaluate the effectiveness of risk mitigation measures. • Professional cybersecurity staff Retain and recruit skilled cybersecurity professionals. Provide regular training and development opportunities. Foster collaboration and knowledge sharing among cybersecurity team members. • Security-aware organizational culture Maintain policies and procedures for reporting and responding to cybersecurity incidents. Empower employees to take ownership of their cybersecurity responsibilities. Promote a security-aware culture throughout the organization through regular training and awareness programs. • Security technology Implement and maintain robust cybersecurity technologies, including advanced threat detection, prevention and response tools. Regularly evaluate and update our suite of cybersecurity technology to address emerging threats and vulnerabilities. Integrate cybersecurity technologies with other systems and processes.

companyName: Lazard, Inc.

ticker: LAZ


text: We have also adopted physical, technological and administrative cybersecurity controls including, among other items: • a dedicated cybersecurity incident response team, the Security Incident Response Team (SIRT), which is comprised of internal resources and an external vendor, Managed Security Services Provider (MSSP). The MSSP triages based on a combination of predetermined rules. When the MSSP has validated a true positive event, it is communicated to the internal SIRT team for deeper investigation and response; • a written policy provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents; • perimeter and endpoints firewalls, intrusion prevention systems, endpoint detection and response, Attack Surface Management, multi-factor authentication and email protection; • annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. • routine testing of and training on our IT systems, including test phishing emails and awareness training opportunities; • cybersecurity policies, standards and practices that follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and follow evolving information security regulatory guidance for countries in which we operate; • automation and alerts via embedded tools and procedures to monitor data and notify us of threats or other potential unauthorized occurrences on or conducted through our systems; • sharing threat intelligence daily with each business unit; • multiple mechanisms by which employees can report cybersecurity and data privacy concerns, including a "Report Phish" button in the email application; • internal audits on our cybersecurity and data privacy practices; • a vulnerability management program designed to protect our external and internal networks and critical assets; • an ongoing process of identifying, assessing, reporting on, managing and remediating cybersecurity vulnerabilities across endpoints, workloads and systems; and • a level of cybersecurity insurance that Unisys believes is appropriate, taking into consideration the material risks from cybersecurity threats.

companyName: UNISYS CORP

ticker: UIS


text: Incident reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Clubhouse Media Group, Inc. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Clubhouse Media Group, Inc.


text: In an effort to deter and detect cyber threats, we provide all employees, including any part-time employees, with a data protection, cybersecurity, and incident response and prevention training program designed to educate employees on the importance of identifying and reporting all potential data security incidents immediately. The training covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. We also use technology-based tools to mitigate cybersecurity threats and risks and to bolster our employee-based cybersecurity programs.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: Our S&RC chair has previously served in the role of Chief Information Officer at two large companies for over 15 years. Other members of the S&RC have extensive years of executive and operational leadership experience at several global technology and telecommunications companies. Management's Role in Assessing and Managing the Company's Material Risks from Cybersecurity Threats.


text: Our cybersecurity team also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: LCI INDUSTRIES

ticker: LCII


text: Our cybersecurity risk management program includes among other things: a. Risk assessments designed to help identify significant cybersecurity risks to our critical systems, information and services;

companyName: Douglas Emmett Inc

ticker: DEI


text: We have developed cybersecurity and data privacy programs designed to enable and safeguard the confidentiality, integrity and availability of our information systems and data by providing proactive security expertise and risk assessments, creating and maintaining a resilient and secure environment, and fostering a culture of security awareness and compliance throughout our organization. We maintain a robust Information Security Program that sets forth our commitment to the continual review and improvement of policies, processes, procedures, and standards for evaluating electronic and physical methods of accessing, collecting, storing, using, transmitting, disposing, and protecting sensitive information, including customer information under guidelines established as part of the Gramm Leach-Bliley Act (GLBA).

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: The Company depends on the proper functioning, availability, and security of its information systems, including financial, data processing, communications, and operating systems, as well as proprietary software programs that are important to the efficient operation of the business. The Company also utilizes software applications provided by third parties, grants limited access to the Company's systems to third parties providing specific outsourced functions or other services, and increasingly stores and transmits data using connected information technology or "cloud" systems. Any significant failures or disruptions of the Company's critical information systems, including ransomware attacks or other cyber incidents, that impact the availability or other proper functioning of these systems or that result in the compromise of sensitive or confidential information, including information of tenants, employees, and others (including joint venture partners and Curbline Properties), could result in liability for the Company to third parties and have a significant impact on the Company's operations and reputation.

companyName: SITE Centers Corp.

ticker: SITC


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, manage our cybersecurity program. The CCO supervises our oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as our CCO for more than five years and has worked in the financial services industry for more than 20 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: We utilize a comprehensive, defense in depth approach to cybersecurity risk, which helps us to continually assess, identify and manage enterprise-wide material cybersecurity risks. Our cybersecurity risk management is integrated into our overall Enterprise Risk Management (ERM) process and is reviewed at least quarterly. Our cybersecurity strategy focuses on maintaining the confidentiality, integrity and availability of data. We leverage frameworks established by the National Institute of Standards and Technology and the Center for Information Security for our information and cybersecurity governance program. We have a comprehensive cybersecurity threat detection and monitoring program for our technology and network infrastructure, which leverages various systems, processes, and operational measures to monitor, detect, and respond to cyber incidents. Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices. An Incident Response and Disaster Recovery Plan is maintained and periodically exercised. The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. Resiliency and recoverability are paramount in the plan. This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: The governance of our cybersecurity efforts is overseen by the Audit Committee, which includes individuals with experience in technology and cybersecurity. The board regularly reviews and guides our cybersecurity policies and practices. Management plays a critical role in implementing these policies and in the day-to-day management of cybersecurity risks. They are empowered with the maintenance, communication and enforcement of cybersecurity policies and employ proactive measures to improve cybersecurity through review of various third party cyber tools for potential implementation. Our Head of IT and Chief Financial Officer ("CFO") are responsible for overseeing the implementation of cybersecurity strategies and ensuring compliance with regulatory standards. In addition to our in-house expertise, our independent external auditors and our outsourced internal audit team, regularly test and asses our cybersecurity controls. Any cyber incidents that occur are escalated to the CFO to facilitate resolution. Any incident determined to be material is discussed with the Audit Committee and communicated to our internal and external auditors as well as our third party virtual environment service provider, when relevant.

companyName: INNOVATE Corp.

ticker: VATE


text: The Company uses third-party service providers in various functions throughout its business. The Company has stringent processes to oversee and manage risk with these third parties. The Company's process includes risk assessment activities, such as security assessments of all third-party providers, policies such as "minimum required access" to ensure compliance with current cybersecurity standards and monitoring activities, such as the review of potential cyber breaches announcements made by the third-party service providers.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's information security policies, standards, processes and practices.

companyName: LKQ CORP

ticker: LKQ


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations and to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Our information services team is led by our Vice President Information Services & Technology, who also chairs the Infosec Oversight Committee and has approximately 25 years of experience in the information technology industry. Collectively, the members of our Infosec Committee, Infosec Oversight Committee, and Executive Steering Committee have decades of experience within the information technology and/or cybersecurity areas. On a monthly basis, our Vice President Information Services & Technology provides executive management with an Information Security Scorecard, which includes any cybersecurity events that have occurred. If a cybersecurity incident is declared under the IRP, we will evaluate whether such incident might have a material adverse impact on our business, financial condition, results of operations, or reputation, among other considerations, and communicate that discussion to executive management, who will then determine if escalation to the Board is warranted and if further disclosure is required to the SEC and/or other government agencies.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, providing multiple layers of security, to inform our professionals' risk identification and assessment.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and attesting to our risk management systems, including an annual Systems and Organization Controls 2, or SOC 2, audit with respect to the security, availability, confidentiality, and process integrity trust services criteria, or TSC. Our collaboration with these third-party service providers includes regular audits, threat assessments, and consultation on cybersecurity strategy and enhancements. Recognizing the risks associated with these and other third-party service providers, we also conduct risk assessments on selected systems and third-party service providers on an ongoing basis.

companyName: Natera, Inc.

ticker: NTRA


text: Our audit committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Periodically, reports are provided to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters, primarily through presentations by the CISO and the Ares' Head of Enterprise Risk. Such reporting includes updates on Ares' cybersecurity program as it impacts us, the external threat environment, and Ares' programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and Ares' preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: IT leadership will, when required by either executive management or the Board, engage third-party reviews of our overall cyber security compliance using The National Institute of Technology ("NIST") framework. IT leadership will also periodically engage specialist security contractors to test the Company's resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.

companyName: INNOSPEC INC.

ticker: IOSP


text: As described above, the Company's cybersecurity program is led by the CISO, who ultimately reports to the Executive Vice President and CIO. The CISO is supported by an information security team, made up of two security analysts and one IT audit and compliance analyst. The security analysts monitor the Company's security solutions and security event logs and responds to incidents and events when they occur. The IT audit and compliance analyst tracks remediation efforts, manages the Company's third party risk program and works with internal and external auditors on all IT compliance activities. Members of the information security team hold cybersecurity certifications, such as a Certified Information Systems Security Professional ("CISSP") or Certified Information Security Manager certifications. The CIO oversees all IT departments within the Company, including security and risk, and is the primary liaison between IT and the Board of Directors.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management ("TPRM") program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.

companyName: KORN FERRY

ticker: KFY


text: As part of its overall risk management framework, the Company maintains an Information Security Oversight Committee ("ISOC") which is responsible for overseeing company-wide cybersecurity strategy, architecture and policies. The Company's ISOC is chaired by its Chief Information Security Officer (the "CISO"), who reports to our Chief Information Officer, who is also a member of ISOC. The Company has also established an Incident Response Team ("IRT"), which is a subset of the ISOC, and maintains an Incident Response Plan ("IRP"), the purpose of which is to respond to cybersecurity incidents. The IRT assesses the risks and impacts of cybersecurity incidents and creates and manages action plans for each specific cybersecurity incident. The IRP is designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: Solo Brands, Inc.

ticker: SBDS


text: We regularly review our information security program and associated policies, making periodic updates as we deem necessary and appropriate in accordance with recognized best practices and standards.

companyName: Red Violet, Inc.

ticker: RDVT


text: Our Board of Directors, which also oversees our general risk management, has specific oversight responsibility for cybersecurity. The Board of Directors reviews and discusses with management our policies, practices and risks related to information security and cybersecurity. Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. Our chief financial officer provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

companyName: Maison Solutions Inc.

ticker: MSS


text: We operate cybersecurity threat intelligence and monitoring programs that utilize third-party tools and services, commercial and open-source threat intelligence, and cybersecurity communities like the Automotive ISAC to identify and assess threats. Security events are evaluated and prioritized for response and remediation.

companyName: Canoo Inc.

ticker: GOEVQ


text: We also employ processes designed to identify and reduce the potential impact of a security incident at a third-party vendor or otherwise implicating the third-party technology and systems we use.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Once we are operational and have available funding, we will be committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we plan to implement a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets.

companyName: Relativity Acquisition Corp

ticker: ACQC


text: Noble is not aware of any current or potential risks from cyber security threats, incidents, or exposures that have or may have materially affected or are reasonably likely to materially impact Noble's business strategy, results of operations, or financial condition. Potential cybersecurity risks to Noble are shared in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Noble Corp plc

ticker: NE


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the FE Audit Committee, the FE Operations and Safety Committee, and the FE Board, as described in greater detail below.

companyName: FirstEnergy Transmission, LLC


text: Our management team, including our Chief Information Officer and VP, Head of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer and VP, Head of Information Security have more than 40 years of combined experience in the field of information technology.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Our Board of Trustees, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.

companyName: Ellington Credit Co

ticker: EARN


text: A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.

companyName: NN INC

ticker: NNBR