text: At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of the board of directors for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The CISO has extensive technology work experience, having served in various roles in risk management, including information security audit and assessments, developing cybersecurity strategy/programs for enterprise and product security, and cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CISO has also held leadership positions in several health sector industry organizations developing cybersecurity standards and best practices.

companyName: ABBOTT LABORATORIES

ticker: ABT

secItem: Item 1C


text: DPL Inc. and AES Ohio The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cybersecurity professionals that manage the operational technology (OT) network security of DPL and its subsidiaries to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and PUCO regulation.

companyName: DAYTON POWER & LIGHT CO


text: The Company's board of directors is responsible for overseeing and approving our cybersecurity strategy and policies. Our board of directors receives updates from management on the Company's cybersecurity status and initiatives and provides guidance and feedback on the cybersecurity goals and objectives. Our board of directors also monitors the Company's cybersecurity risks and exposures and ensures that the company has adequate cybersecurity resources and capabilities to protect its data and systems.

companyName: Mitesco, Inc.

ticker: MITI


text: Employees are required to complete annual cybersecurity training. The training is updated periodically in order to stay up to date with current laws and was last updated in the fourth quarter of 2023. The General Partner models risks, including security risks, and allocates risk capital accordingly, and does not carry cyber insurance.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: Central management and coordination of the program helps FirstEnergy to comprehensively evaluate and protect against cyber threats. FirstEnergy's written policies and procedures identify how cyber security measures and controls are developed, implemented, and regularly reviewed and updated. FirstEnergy aims to align its cyber security program with national standards. For example, FirstEnergy has implemented and maintains a set of controls to manage cyber security risk based on the National Institute of Standards and Technology Cyber Security Framework and, for Bulk Electric System assets, the NERC Critical Infrastructure Protection standards. FirstEnergy also complies with various state laws and regulations on cyber security.

companyName: FIRSTENERGY CORP

ticker: FE


text: Incident Response Plan: The Company has established and maintains an incident response plan that governs the Company's response to a cybersecurity incident, and such plan is evaluated annually. Potentially material cybersecurity risks and incidents are escalated to management and the Board as applicable.

companyName: FARO TECHNOLOGIES INC


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. Our security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols. Additionally, we utilize third parties to conduct periodic cybersecurity assessments and our internal audit function includes certain cyber risk audits as part of its overall risk audit. We review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate. Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: We have an independent consultant who is a cybersecurity expert who has advised us on the above systems and procedures. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: Engagement of Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants and systems auditors, in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, threat and vulnerability assessments, incident response plan design and testing, penetration testing, and consultation on improving our defense-in-depth security posture.

companyName: INSPERITY, INC.

ticker: NSP


text: We conduct annual risk assessments to identify cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management and assessment process also encompasses cybersecurity risks associated with our use of third-party service providers.

companyName: Clarus Corp

ticker: CLAR


text: The Custodians are responsible for safekeeping all of the SOL owned by the Company. We maintain multiple Custodians to reduce the risk of a single failure and we plan to expand to additional custodians as our Treasury grows. The Custodian accounts are all opened by the Company, this segregates our assets into an individual custodian account owned by the Company and access is monitored and controlled by the Company. Our Asset Management Company is given access to the Custodian accounts with established controls to ensure transactions require consensus of a minimum of two individuals when assets are being transferred between wallets and additional controls if an asset of the Treasury is moved out of the Custodians control. The assets go through the Custodians Trust Company, which maintains its own insurance and is regulated by their respective state where the trust is incorporated in.

companyName: UPEXI, INC.

ticker: UPXI


text: The Company's Enterprise Risk Management Committee, which is a management committee consisting of key employees of the Company, including the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Credit Officer, Chief Administrative Officer, Chief Information Officer, and Chief Risk Officer, oversees implementation and monitoring of the Information Security Policy and Program. Testing of the Information Security Policy and Program is accomplished through the use of a comprehensive Information Systems Audit that is performed, at a minimum, on an annual basis by third-party expert consulting firms, the results of which are reviewed with the Risk Oversight Committee and Audit Committee. The company also conducts an internal and external penetration test, at a minimum, on an annual basis by outside expert consulting firms. In addition, in accordance with the Information Security Policy and Program, the Company's Enterprise Risk Management Committee assesses information security risks on at least an annual basis, or more often in response to changes in products or services that are offered, technological changes, changes in the threat landscape facing the Company, including as a result of cybersecurity incidents affecting financial institutions or their vendors generally or any change that may materially affect the Company's risk environment.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Our Cybersecurity Program Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: The Company recognizes that the security of our banking operations is critical to protecting our customers and maintaining our reputation. The cybersecurity landscape is constantly evolving. To mitigate these risks, the Company deploys a comprehensive and resilient information security program that consists of a layered security model using industry leading hardware, software, and services to protect customers' and the Bank's data and to ensure the confidentiality, integrity, and availability of our information systems. This information security program is a critical component of our overall enterprise risk management program.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: The Board's Risk Oversight Committee is responsible for oversight and monitoring of the Company's cyber risk management profile and related programs. In an effort to ensure transparency and provide appropriate oversight and monitoring, the Chief Risk Officer and Chief Information Security Officer present detailed reports to the Risk Oversight Committee on a quarterly basis. These reports address the current landscape of cybersecurity threats, any notable recent incidents, and a summary of emerging cybersecurity trends. The Board is also regularly furnished with key risk indicators and defined risk parameters with respect to the Company's cybersecurity program. The Board reviews and approves the Company's cybersecurity policies at least annually.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Personnel assessing, monitoring and managing our cybersecurity risks rests with our information technology provider, who leads testing of our compliance with standards, remediation of known risks, and our employee training program. Our information technology providers lead our implementation and oversight of processes for the regular monitoring of our information systems.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: The maturation and scaling of our cybersecurity program is ongoing and despite our investments in our cybersecurity program, there will always be residual risk and the potential for control failure or bypass by a determined cyber threat actor.

companyName: Marqeta, Inc.

ticker: MQ


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future.

companyName: EchoStar CORP

ticker: SATS


text: –Audit Committee of the Board of Directors: The Audit Committee is responsible for discussing the Company's major information technology risk exposures, including cybersecurity, and the steps management has taken to monitor and control such exposures. The Audit Committee dedicates attention to and provides oversight of certain cybersecurity risks. The Chief Information Officer and Corporate Vice President, IT Infrastructure Operations and Security, meet with the Audit Committee regularly to assess management's progress on implementing process and procedure improvements related to cybersecurity. The Audit Committee also provides guidance on long-term and short-term cybersecurity strategies.

companyName: CEDAR FAIR L P


text: Transparent reporting and communication are key components of 8x8's cybersecurity program. Incidents are promptly reported to the Chief Information Security Officer, who is responsible for escalating to relevant stakeholders, including executive leadership, the internal disclosure committee, and the Board of Directors, as required. Regular communication channels ensure that stakeholders are kept informed of the Company's cybersecurity posture and any emerging threats or incidents.

companyName: 8X8 INC /DE/

ticker: EGHT


text: As a result, we have policies and processes in place to assess, identify, and manage the strategic and operational IT-related risks as an integrated part of our overall risk management system. These risks include the risk of cyber-attacks on IT infrastructure and intellectual property, as well as on cybersecurity for our online product offerings. The Company has adopted Risk Assessment Methodology Policy, Information Security Policy and Incident Response Plan Policy to managing material risks from cybersecurity threats and hired IT consultant to help managing cybersecurity risks. When the Company uses a third party service provider and shares sensitive data such service provider, it must adhere to the compliance requirements in the Service Agreement which includes an acknowledgement that the service provider is responsible for safeguard and the security of the sensitive data. As of date of this report, there has been no previous cybersecurity incidents, have materially affected the Company yet. The independent director of the Board Charlie La is responsible for the oversight of risks from cybersecurity threats on behalf of the Board. Mr. Teng Ai Leng, our IT consultant and Tawny Lam, Chief Executive Officer of the Company report to Mr. Charlie La and Board of Directors for cybersecurity risks and incidents. Teng AI Leng has 30 years of working experience in the Information technology industry. The Company has adopted Incident response plan policy, including Roles and Responsibilities, Incident Categories, Categories of Event, Incident Severity, Escalation Levels, and Incident Response Life Cycle, so that the weakness, events, alerts and incidents can be appropriately managed and escalated from IT personnel, IT consultant, Chief Executive Officer to independent director and the Board.

companyName: XMax Inc.

ticker: XWIN


text: The CISO is also responsible for monitoring data security incidents at third parties who have access to the Company's information which may impact the Company or its customers if it was compromised. When the Company becomes aware of such events, the CISO engages with the impacted third-party service providers to understand the incident, assess the risk that the Company's information was released, and determine methods by which the Company can mitigate the damage, if any, and fulfill its notification obligations to impacted parties.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Cyber risk monitoring also includes the Company's arrangements with and exposure to third party service providers. We identify the criticality of our third-party service providers, in part, by determining their use of and access to confidential customer information. We conduct comprehensive cybersecurity reviews on all third parties that have access to confidential information. Our third-party reviews make use of technology that provides significant visibility into third party organizations, in real time, to assess third party compliance with a host of globally recognized IT security standards and frameworks and the likelihood of a cyberattack on a third party.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our MIT regularly reports to and reviews our cybersecurity processes with the Audit Committee, with formal cybersecurity reviews with the Committee generally occurring at least annually, and sometimes more frequently, as appropriate.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Because technology, data and information security is a top priority at Blackbaud, we maintain and continuously assess and strengthen our cybersecurity program. Comprehensive cybersecurity risk management, including identification, analysis and response to risks affecting our business and its customers, provides the foundation for our program.

companyName: BLACKBAUD INC

ticker: BLKB


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer ("CFO") and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: We design and assess our program based on the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: The audit committee maintains a cybersecurity sub-committee that is comprised of our EVP, Chief Information Officer ("CIO"), our SVP, Chief Information Security Officer ("CISO"), and representatives from the audit committee and board of directors that have knowledge and experience in cybersecurity matters. The cybersecurity sub-committee reviews our cybersecurity risk assessments and the steps being taken to monitor, control, and report on those risks as well as discusses regulatory and market developments. They also review our process for identifying and responding to cybersecurity incidents in a timely manner, and details of cybersecurity attacks or incidents which have occurred.

companyName: lululemon athletica inc.

ticker: LULU


text: Supplier risk assessments: We have participated in several third-party risk assessment processes that include expectations regarding information and cybersecurity. NeurAxis also seeks contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect NeurAxis information that is processed or stored on their systems. This may or may not include business associate agreements, downstream vendor agreements and vendor auditing in some cases.

companyName: Neuraxis, INC

ticker: NRXS


text: The Company has a Computer Incident Response Team ("CIRT") which is responsible for monitoring, preventing, detecting, assisting with the investigation, and responding to cybersecurity threats. The Company has in place an Information Security Incident Response Plan ("IRP") Protocol which provides an operational framework to coordinate the response to any type of cybersecurity incident affecting the Company. The CIRT team informs the CISO of cybersecurity threats consistent with the IRP. The IRP also provides the process and oversight to manage cybersecurity incidents that may arise from a third-party service provider. In addition, the IRP addresses management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Risk Management Strategy As a financial institution, cybersecurity presents significant risks that could materially impact the Company's operations, financial performance, and reputation. A successful cyberattack could result in operational disruptions, financial losses, regulatory scrutiny, legal liability, and reputational damage. Accordingly, the protection of customer and business information is a top priority. Cybersecurity risk management is a component of the Company's formal Information Security Program. The Information Security Program is incorporated into the Company's Enterprise Risk Management Program, ensuring a holistic approach to risk prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Cybersecurity and Technology Controls Operating Committee ("CTOC") is the principal management committee that oversees J.P. Morgan's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of J.P. Morgan's Information Security Program. The membership of the CTOC includes representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including Independent Risk Management ("IRM") and Internal Audit. The CTOC includes members of J.P. Morgan management that have extensive experience in various technology and information security disciplines, including relevant employment in financial services and other highly regulated industries.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: The Board exercises its cyber risk oversight primarily through executive management, our CIO and our CISO. Our CIO and CISO have expertise in the areas of information security and cybersecurity, through decades of management, prominent cybersecurity training, and real-world experience. Intimate knowledge of best practices, incident response, technologies, and IT and business processes enable the management team to be effective in their approach.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Cybersecurity threats have the potential to materially affect our company, including our business strategy, results of operations, and financial condition. While we have not experienced material adverse effects from cybersecurity threats to date, we recognize the dynamic nature of these risks and remain vigilant in our efforts to mitigate potential impacts. Refer to "Item 1A. - Risk Factors" in this Annual Report on Form 10-K, including, "We could experience a significant disruption in or security breach of our information technology system which could harm our business and adversely affect our results of operations," for additional discussion on our cybersecurity related risks.

companyName: AstroNova, Inc.

ticker: ALOT


text: Cybersecurity Governance Sixth Street has a dedicated cybersecurity team, led by its Head of Technology Risk, who works closely with Sixth Street's Cybersecurity Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. Sixth Street's Cybersecurity Committee includes its Chief Information Officer, Chief Risk Officer, General Counsel, Co-Chief Operating Officer and Chief Compliance Officer, as well as our Chief Financial Officer and Chief Compliance Officer.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: The responsibility for assessing and managing cybersecurity risks within the Company lies with the managers of the R&D department and the IT department. Both individuals possess relevant expertise in their respective fields, ensuring a high level of competence in identifying and mitigating cybersecurity risks. Their duties include monitoring potential threats, implementing security protocols, and responding the event of cybersecurity incidents or abnormal alerts, the relevant department managers immediately intervene and manage the situation.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: The Corporation's cybersecurity program is managed by the Corporation's Vice President of Information Technology (IT), with support from cross-functional teams led by ExxonMobil IT and operational technology (OT) cybersecurity operations managers (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.

companyName: EXXON MOBIL CORP

ticker: XOM


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain providers. We have a vendor management program to manage cybersecurity risks associated with our use of service providers. The program includes, as applicable, risk assessment for certain vendors, security questionnaires, review of certain vendors' security programs and security assessments, and imposition of cybersecurity-related contractual obligations for some vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: We utilize an in-depth layered approach to security. This allows us to respond and proactively mitigate cybersecurity risks, underscoring our commitment to the confidentiality, integrity, and availability of our data and systems. The Company has processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. Our strategy includes the deployment of advanced security products and rigorous penetration testing to identify and mitigate vulnerabilities by continuous vulnerability scanning and round-the-clock monitoring by both internal and external teams. This proactive stance is further bolstered by backup and recovery protocols, ensuring data resilience, and enhanced by email security measures and endpoint detection and response systems to thwart malicious activities.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Impacts from Cybersecurity Threats As of the date of this report, though we and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. See "Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The Company's information technology and risk management function is highly centralized, with the Corporate Controller and Vice President of Information Technology involved in most of the risk related activities which provides a consistent input throughout risk management activities as well as aiding in identifying dependencies and duplications. The Company engaged a third party who conducted its phishing and penetration tests in 2023. The Company is in the process of implementing new processes, procedures, and tools as a result of the observations from these tests and expects all actions to be implemented during 2024.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing its cybersecurity management systems and IRP. These partnerships enable the Company to leverage specialized knowledge and insights, to assist in updating its cybersecurity strategies and processes to align with industry best practices. The Company's collaboration with these third parties includes consultation and review of security enhancements.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: We have implemented processes designed to mitigate risks related to data breaches or other security incidents originating from third parties. With our vendors, we conduct thorough security assessments of key third-party providers before engagement and maintain ongoing monitoring to ensure their compliance with our cybersecurity standards.

companyName: WORLD KINECT CORP

ticker: WKC


text: We also engage vendors to assist with enterprise managed detection and response, global security operations center, security information and event management, and enterprise vulnerability management. In addition, we have implemented a cybersecurity third party risk management process to assess mission and business critical third parties for cyber risks and to assist the business in making risk-informed technology product and services decisions. Our practice is to perform due diligence, including the completion of security questionnaires and risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.

companyName: Deciphera Pharmaceuticals, Inc.


text: Board Oversight of Cybersecurity Risks Our Board of Directors (Board) is responsible for the oversight of our risk management program and regularly reviews information regarding our most significant strategic, operational, financial, legal and compliance risks, including cybersecurity risks. The Board reviews mitigation plans through discussions with management, which includes regular Board reports and findings from management's monthly discussions with our outside IT group. Our Board of Directors also reviews and approves our cybersecurity policies, strategies, and budgets on an annual basis.

companyName: Inhibikase Therapeutics, Inc.

ticker: IKT


text: Personnel and managing our cybersecurity risks rests with the CEO, Mr. Martin Shen, and the CFO, Mr. Yew Hon Lee, working in close coordination with Mr. ShenJian, the IT Manager of our China Operations. Messrs. Shen and Lee have experience in overseeing IT Functions, including cybersecurity. Mr. ShenJian (the IT Manager) has 24 years of experience in technical work since graduating from Jiaotong University in June 2000 with a major in technology. His expertise is critical in designing, implementing, and executing our cybersecurity strategies.

companyName: FingerMotion, Inc.

ticker: FNGR


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Chief Digital and Technology Officer and Chief Information Security Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit and Finance Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Supply Chain Attacks: Attackers may target third-party vendors, suppliers, or service providers to international seaways to gain unauthorized access to their systems or data.

companyName: International Seaways, Inc.

ticker: INSW


text: We maintain a Cyber and Data Security Incident Response Plan to more effectively respond to cyber and information security events. Periodically, we conduct a cybersecurity incident response tabletop exercise to test response actions of the Security Incident Response Team, to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics and to update the plan with any lessons learned from the exercise.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: At a high level, the key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and improving processes continuously. Our cybersecurity program in particular focuses on the following key areas:

companyName: GRESHAM WORLDWIDE, INC.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG also conducts annual assessments of TPG's cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework as benchmarks to perform TPG's evaluation. This does not imply that TPG fully meets any particular industry standards, specifications or requirements. In addition, independent reviews of TPG's cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. TPG also engages external providers to conduct periodic external assessments, including penetration testing.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: The Company's Chief Financial Officer, or CFO, with assistance from our third-party cybersecurity vendors, is responsible for identifying, assessing, and managing our cybersecurity threats and risks. Together, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, evaluating our and our industry's risk profile, conducting real-time monitoring of certain systems, and implementing escalation protocols with our third-party cybersecurity vendors.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: We employ a range of tools and practices to assess, monitor, and mitigate cybersecurity risks. These practices extend to third-party service providers who have access to our systems and data. At least every two years, we engage an independent third party to conduct penetration testing and risk assessments of our cybersecurity posture.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Therefore, we will experience risk to potential vulnerabilities now and in the future but have built a program to recognize and respond to these threats and/or vulnerabilities for the purposes of identification and remediation of those threats and/or vulnerabilities and the impact they can have on our business. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, but there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in significant costs related to, for example: rebuilding our internal systems, implementing additional threat protection measures, providing modifications to our websites and mobile applications, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing merchants and customers with incentives to maintain a business relationship with us, taking other remedial steps with respect to third parties or incurring significant reputational harm. In addition, these threats are constantly evolving, which increases the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in the volume, frequency and sophistication of cyberattacks. We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications; however, we remain potentially vulnerable to known or unknown threats. It is also possible that we, our merchants, our customers or our vendors will be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See Item 1A. - Risk Factors for more information on our cybersecurity risks.

companyName: Groupon, Inc.

ticker: GRPN


text: Third Party Risk Management – Third parties with access to data or infrastructure must go through a vetting process to ensure they comply with reasonable and industry accepted security practices. The vetting process includes assessments, review of third-party attestation and inclusion of standard security language in contracts. Security staff work closely with legal, procurement/sourcing personnel and other stakeholders within the Company on third party compliance practices.

companyName: CINCINNATI BELL INC


text: The Governance Committee of our Board of Directors oversees the Company's guidelines, policies and processes to assess and manage the Company's exposure to risks, which include cybersecurity risks. The Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures. As necessary, our Cybersecurity Incident Management Team ("CIMT") (described below) reports significant cybersecurity threats and incidents to the Governance Committee. The Governance Committee is also periodically briefed by management, including our Chief Digital Officer ("CDO"), with respect to our cybersecurity posture to facilitate its role in overseeing the Company's overall cybersecurity program.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Ault Disruptive Technologies Corp


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: We use, store and process data for and about our customers, employees, partners, and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Laser Photonics Corp

ticker: LASE


text: Our cybersecurity policies and procedures have been developed to ensure an adequate and consistent approach to the management, control, and protection of our information ("Information Assets"). Our Information Assets include business information, customer information and external business partner information, including, without limitation, classified information, information relating to research, intellectual property, personally identifiable information, business and product development, clinical test and evaluation data, and business plans, customer and supplier information, supply chain, manufacturing, distribution, finance, human resources, consulting, partnerships, contracts, and corporate transactions, maintained in any form or format or location, including audio, video, paper, magnetic, electronic and optical.

companyName: Clene Inc.

ticker: CLNN


text: Engage Third Parties on Risk Management the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.

companyName: ACELYRIN, Inc.


text: DIRTT has developed and implemented a cybersecurity risk management strategy which consists of 5 phases: Identify, Protect, Detect, Respond, and Recover. Each phase has multiple processes and technologies supporting those processes. Identification processes at DIRTT include: system asset identification, threat identification, vulnerability identification and maintaining cybersecurity policies and standards.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: The Verizon Executive Security Council (VESC) oversees and evaluates the work of the CISO and their team. The VESC is jointly chaired by the presidents of Verizon Global Services and Global Networks and Technology and includes Verizon's Chief Compliance Officer, Chief Legal Officer, Senior Vice President of Internal Audit and senior executives in business and technology functions. The VESC provides oversight of all aspects of Verizon's cybersecurity program and, at regular intervals throughout the year, evaluates key cybersecurity metrics as well as planned and ongoing initiatives to reduce cybersecurity risks.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Under a final rule adopted by federal banking agencies in 2021, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a "computer-security incident" has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization's ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss, or its operations that would impact the stability of the United States. The federal banking agencies have also adopted guidelines for establishing information security standards and cybersecurity programs for implementing safeguards under the supervision of the Board of Directors. These guidelines, along with related regulatory materials, increasingly focus on risk management and processes related to information technology and the use of third parties in the provision of financial services. Moreover, recent cyberattacks against banks and other financial institutions that resulted in unauthorized access to confidential customer information have prompted the federal banking regulators to issue more extensive guidance on cybersecurity risk management. Among other things, financial institutions are expected to design multiple layers of security controls to establish lines of defense and ensure that their risk management processes address the risks posed by compromised customer credentials, including security measures to authenticate customers accessing internet-based services. A financial institution also should have a robust business continuity program to recover from a cyberattack and procedures for monitoring the security of third-party service providers that may have access to nonpublic data at the institution.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The Board and the Audit Committee each receive quarterly presentations and reports from the Company's Chief Technology Officer and/or General Counsel on cybersecurity risks, which address a wide range of topics including, among others, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third party service providers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds under the Company's incident response plan.

companyName: Phreesia, Inc.

ticker: PHR


text: Cybersecurity events are continuously monitored by global security operations centers staffed in the United States, European Union, and Asia Pacific regions with events and incidents being managed based upon the MITRE ATT&CK framework, a system for classifying and describing cyberattacks and intrusions. Management provides guidance and is informed of cybersecurity events through a committee with cross-functional representation of executive leadership. The committee meets at least quarterly for activities such as determining policy, reviewing active risks, assessing impact of emerging threats or regulatory changes, and monitoring active incidents. This committee also receives escalated alerts within 24-hours of confirmed cybersecurity events, and will determine the severity of the incident, engage with crisis management as necessary, and disseminate that information internally as appropriate and warranted. The Company's generative artificial intelligence strategy is to "Generate Responsibly," actively providing education and awareness, encouraging the safe exploration of generative AI tools and resources, consistent with Company data protection policies and standards.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. None.

companyName: NYIAX, INC.


text: We engage certain external parties, including cybersecurity and privacy firms and consultants, to provide IT support and cybersecurity oversight, and enhance our risk reduction abilities, including the engagement of a third-party to review our cybersecurity program to help identify areas for continued focus and improvement. We also use automated tools designed to monitor, identify, and address cybersecurity risks.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: We maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps us inform our cybersecurity agenda and prioritize our cybersecurity activities. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives. has implemented risk management structures, policies and procedures and is responsible for our day-to-day cybersecurity risk management. Our Director of Information Technology, Chris Dennis, is responsible for our day-to-day assessment and management of cybersecurity risks.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts an extensive periodic review of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to a separate committee comprised of officers charged with reporting responsibilities to determine overall materiality and disclosure obligations.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Data Breaches: Despite implementing robust security measures, systems and networks may be breached, leading to unauthorized access to customer data, proprietary information, or intellectual property.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk-oversight function as a whole, as well as through the audit committee.

companyName: IMPINJ INC

ticker: PI


text: We have implemented a comprehensive information security program to assess, identify, and manage material risks from cybersecurity threats. This program includes policies and procedures that guide the development, implementation, and maintenance of security measures and controls. We utilize industry-standard metrics to evaluate the criticality of software, data assets, and operational technology. Our cybersecurity efforts align with the Center for Internet Security (CIS) Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework, with annual assessments to ensure compliance.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Additionally, we assess our cybersecurity maturity annually using the NIST framework and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access, and removable media.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: As of the date of this report, the Company has no t identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party business partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this report.

companyName: SKYX Platforms Corp.

ticker: SKYX


text: Our Chief Product Officer has been with Pega for thirty-one years, has extensive experience in software development, and has a Bachelor of Science from the Indiana University of Pennsylvania.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the ISO 27002 and NIST SP 800-37 Rev. 2 frameworks, to which risk management in relation to our information systems is aligned. We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with anomaly identification enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: Cybersecurity Risk Management Strategy Overview and Goal. Fannie Mae has a multilayered cybersecurity defense strategy. We take a risk-based approach that prioritizes the highest impact events. Our cybersecurity threat operations operate with the goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with incident response and recovery plans.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: As described in more detail in "Risk Management — Overview" in Item 7 of this report, the Board serves in an oversight capacity to ensure that Key's risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board's Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management's activities related to cybersecurity risk. The Board's Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board's Technology Committee provides additional oversight of management's activities related to Key's technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.

companyName: KEYCORP /NEW/

ticker: KEY


text: Our corporate information security organization, led by our Chief Information Officer ("CIO"), is responsible for our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. This team's leadership includes professionals with deep cybersecurity expertise. This team collaborates with technical and business stakeholders across our businesses to analyze risk and form detection, mitigation and remediation strategies. They engage outside legal counsel, experts, consultants, and other third parties to perform regular audits, assist with forensic investigations, or address cybersecurity threats and incidents. As appropriate, they obtain input on the security industry and threat trends from external experts and consultants.

companyName: Xperi Inc.

ticker: XPER


text: Our management cybersecurity committee, led by our CFO and Director of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of Information Security has served in various roles in information technology and information security for over 20 years. Our managed service provider has over 20 years of experience managing multi-national IT operations, including strategy, applications, infrastructure, information security, support, and execution.

companyName: Plymouth Industrial REIT, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including a dedicated information technology manager, who reports to the CEO. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

companyName: Leatt Corp

ticker: LEAT


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, like artificial intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company's cybersecurity controls are incorporated into our internal control environment, managed and tested in accordance with the Sarbanes-Oxley Act. When a weakness in the Company's technical safeguards is identified, the Company works to mitigate and prevent exploitation of the Company's information.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO) and Chief Financial Officer (CFO), who reports to our Chief Executive Officer (CEO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director and the Cybersecurity consultant expert. Our CISO reports to the Audit Committee or the Board of Directors on cybersecurity risks and timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: BK Technologies Corp

ticker: BKTI


text: We are not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, our business strategy, results of operations or financial condition.

companyName: ITC Holdings Corp.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition. See Item 1A. Risk Factors for further information.

companyName: TREDEGAR CORP

ticker: TG


text: The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer ("CISO") manages our information security strategy and development as overseen by our overarching Enterprise Risk Management ("ERM") program.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our Board and our Audit Committee receive reports on the Company's cyber security program, including an assessment of that our cybersecurity risk management program, annually or as needed. In addition, the Board and Audit Committee receive reports on the cybersecurity program, including any material cybersecurity risks, periodically or as needed.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Cybersecurity Program, recent developments, evolving standards and emerging threats or trends within cybersecurity. The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.

companyName: BORGWARNER INC

ticker: BWA


text: Review and provide oversight on the Company's disaster recovery, business continuity, and business resiliency capabilities, including escalation protocols, relating its customer-facing products and services and internal-use information technology systems; Review annually the appropriateness and adequacy of the Company's cyber-insurance coverage;

companyName: Cohen & Co Inc.

ticker: COHN


text: ORIX USA maintains a cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of cybersecurity incidents. The plan and run books are tested annually through cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current cybersecurity threats. ORIX USA's cybersecurity incident response plan provides for escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our Company, and evaluation of the adequacy of our cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when to send notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Risk Council, composed of professionals across a variety of departments and jurisdictions in our organization. Our cybersecurity program utilizes methodologies, reporting channels and governance processes across our subsidiaries that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas that are assessed and reviewed when onboarding new vendors, customers, product lines or shifts in our service delivery models.

companyName: ATN International, Inc.

ticker: ATNI


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact have not identified or experienced, or will not experience, a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: We have developed and implemented various processes to oversee and manage cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: The Audit Committee receives periodic reports from management, including our IT Governance Team, on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: We maintain a security threat intelligence system that collects and analyzes data from internal vulnerability management tools, vendors, and third-party security organizations. Our patch management standard is designed to ensure that appropriate patching practices are consistently applied to our technology infrastructure, and a Security Operations Center enhances our real-time awareness, event correlation, and incident response capabilities.

companyName: CLARIVATE PLC

ticker: CLVT


text: Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned, or managed by us. Our focus is on protecting sensitive information, such as the personal information of our customers and employees, and confidential business information that a competitor or a malicious actor could leverage.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: The Board remains committed to ensuring cybersecurity remains a priority for the organization and that the appropriate resources and governance structures are in place to manage cyber risks effectively.

companyName: URBAN ONE, INC.

ticker: UONE


text: Program Adjustments The COO, with the assistance of the IT Manager, monitors, evaluates, and adjusts the Information Security & Network Systems Policy considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: The Corporation maintains a Cybersecurity Incident Response Plan (the "CSIRP"), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation's assets. Pursuant to the CSIRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the CITSO and the VP of Information Security primarily lead these efforts.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: We conduct annual reviews of third-party hosted applications where sensitive Company data is shared. Additionally, cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties, employees and their beneficiaries, and customers) and other data. These incidents have not had a material impact on our services, systems, or business. However, despite our capabilities, processes, and other security measures we employ, we may not be aware of all vulnerabilities or might not accurately assess the risk of an incident. Additional information on cybersecurity risks we face can be found in Item 1A. Risk Factors, which should be read in conjunction with the foregoing information.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: The Senior Director, GIS, who has been a head of information security for close to 15 years and has more than 27 years of overall experience in IT and cyber security industry, holds a Bachelor of Science in Information Technology from Bina Nusantara University and Master of Business Administration from University of Liverpool.

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks. In addition, management updates the Audit Committee, when it deems appropriate, regarding cybersecurity incidents it considers to be significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: FuboTV Inc.

ticker: FUBO


text: On an annual basis, the CISO reviews the information security program achievements and reports to the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the information security policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the security program, and reviews corrective action to improve the program.

companyName: LivaNova PLC

ticker: LIVN


text: The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board's legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022 and 2023 in overseeing the development of the Company's Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.

companyName: Vericel Corp

ticker: VCEL


text: We, like any technology company in the current environment, have experienced cybersecurity incidents in the past, but we have not experienced a cybersecurity incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Risks Related to Our Platform and Data."

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: Management's Involvement in the Oversight of Cybersecurity Risk Our CIO, who reports to our Senior Vice President & Chief Financial Officer, oversees our cybersecurity function. The Cybersecurity Manager reports to the CIO, and the CIO and Cybersecurity Manager are responsible for assessing and managing risks from cybersecurity threats, as well as our overall information security strategy, policy, security engineering, operations, and cybersecurity threat detection and response, and reporting on cybersecurity matters to the Board and executive management.

companyName: NPK International Inc.

ticker: NPKI


text: The Bank's information security program undergoes rigorous internal and external auditing. The internal audit team and bank examiners conduct annual reviews to evaluate program's effectiveness and risk mitigation efforts. Additionally, external auditors assess specific components of the information security program as part of the annual financial statements audit. The program is designed in accordance with the National Institute of Standards and Technology guidelines and the Cyber Risk Institute Profile recommended by the American Bankers Association underscoring our commitment to maintaining a strong cybersecurity governance framework.

companyName: FB Financial Corp

ticker: FBK


text: We are not aware of any risks from cybersecurity threats, including any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Trust, including its business, results of operations or financial condition. Refer to Item 1A. Risk Factors in this Annual Report on Form 10-K, specifically "Information technology, data security breaches and other similar events could harm the Trust," for additional discussion about cybersecurity-related risks.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: Material Cybersecurity Risks, Threats, and Incidents We have been, and continue to be, the subject of cybersecurity threats, and we describe how risks from these threats, if realized, are reasonably likely to materially affect us. See further discussion of these items in our Item 1A. Risk Factors of this Form 10-K. As of the date of this report, we have not identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations, or financial condition, in the future.

companyName: H&R BLOCK INC

ticker: HRB


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our processes and policies related to cybersecurity are focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv)

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our Head of Information Security and Compliance and our InfoSec management team, in partnership with our legal privacy team, oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Head of Information Security and Compliance and our InfoSec management team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through their implementation and oversight of safeguards, including through the use of automated tools and manual processes, like security event monitoring, vulnerability scanning, threat analytics, security awareness and training, endpoint security, bug bounty program, offensive security testing, and third-party risk and monitoring.

companyName: AppLovin Corp

ticker: APP


text: We intend to implement a formal cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Collaborative Approach. We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: PROS Holdings, Inc.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. See Item "1A.— Risk Factors—Operational Risks – Data security and integrity and digital resilience are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation." for more information about these and other risks related to information security.

companyName: Dun & Bradstreet Holdings, Inc.


text: Omega's Vice President of Information Technology ("VP of IT") manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes and risk assessment related to information security and data protection, including data privacy and network security (our "Cybersecurity Program"). The VP of IT has served in various roles in information technology and information security for over 30 years and, along with other members of the IT department, holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Financial Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our Board and the Audit Committee of our Board.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: The IT Director meets periodically with members of the Relay Information Security Council, or RISC, which is comprised of the VP of IT and senior leaders from various functions, including finance, legal, human resources, corporate development and research and development. The RISC provides input to the IT Director in connection with proposed cyber strategies as it relates to potential business impacts from new or proposed technologies and security solutions across the organization, including implementation strategies designed to address potential risks and disruptions to the business. In the event we or one of our business partners experiences a cybersecurity incident, the RISC is responsible for assisting in evaluating the incident, including whether any disclosure of the incident is required. The VP of IT reports to the Audit Committee on cyber initiatives and implementation resulting from RISC discussions.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: The Company also maintains a system-wide information systems security program that applies to all employees. All employees are expected to assist in safeguarding the Company's information systems and to assist in the discovery and reporting of cybersecurity incidents. This Company-wide program is intended to identify and assess internal and external cyber and information security risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems or those of third-party providers from unauthorized access, use or other malicious acts.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Our corporate IT infrastructure, communication networks, and related systems are essential operational components. These systems manage product development, internal and external communications, accounting functions, data storage, and other critical operations. Our business depends on secure handling of proprietary, confidential, and sensitive data.

companyName: BioRestorative Therapies, Inc.

ticker: BRTX


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital Energy engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.

companyName: Vital Energy, Inc.

ticker: VTLE


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include but are not limited to: Maintaining a defined and practiced incident response plan; Maintaining cyber insurance coverage; Employing appropriate incident prevention and detection safeguards; Maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate;

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: We, like many other companies in the gaming and entertainment space, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: The Executive Vice President, Senior Operations Officer has 35 years of experience in operations and technology with an educational background in Business Administration. In the role of Senior Bank Operations Officer and Executive for the past 24 years, she oversees and works closely with Horizon's technology and security teams to develop and implement robust security measures to protect the Bank's systems, networks, and customer data. The Senior Bank Operations Officer stays current on the latest industry trends and emerging cyber threats through publications, webinars, seminars and banking association training around cyber security. She also collaborates with external agencies, such as law enforcement and regulatory bodies, to address cyber threats and ensure compliance with industry best practices.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response process; conducting risk assessments; encrypting certain of our data; segregating certain of our data; implementing network security controls; maintaining access and physical security controls; asset management processes for managing, tracking, and disposing of assets; monitoring our corporate systems; providing security awareness training to employees; and maintaining cybersecurity insurance.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: As one of the critical elements of our overall risk management program, our cybersecurity program is focused on the following key areas: • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response & Recovery Planning: We have established and maintain incident response and recovery plans that address our response procedures in the event of a multitude of various cybersecurity incidents. We leverage a Managed Detection and Response service which further helps support our internal security team to identify real time threats across our landscape. • Risk Management: We maintain a preemptive and comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks across our entire technology stack. The approach aligns to industry standards such as ISO 27005 (Information Security Risk Management). This approach also includes third-party risk management issues presented by third parties, including our vendors, service providers and other external users of our systems. We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities, including on-site visits for evaluation of certain core operational third-party vendors. In addition, our agreements with material vendors include indemnification provisions with respect to cybersecurity matters. • Outside Consultants: In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, auditors, and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advise on potential improvements to our incident prevention, response, and documentation procedures. • Team Member Education & Awareness: We provide training to new team members, as well as frequent, mandatory training for all team members regarding cybersecurity threats to equip our team members with effective tools to identify and prevent cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: INSEEGO CORP.

ticker: INSG


text: Our cybersecurity risk strategy uses an Information Assurance Program to define the general security policy for our information systems and a Cybersecurity Incident Response Plan for detection, response, recovery, containment, investigation, and analysis following a cybersecurity incident, as well as compliance with legal and regulatory requirements.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: We have formed an Information Technology Steering Committee comprised of employees from multiple departments within the Company including the Chief Executive Officer ("CEO"); the Chief Financial Officer; the Chief Accounting Officer; the Vice President, Controller; the Vice President, Investor Relations & Finance; and the Vice President of Human Resources and Compliance & Information Security Officer ("ISO") to more effectively prevent, detect and respond to information security threats. The ISO has served in various roles in corporate compliance for over 20 years and reports directly to the Company's CEO. To enhance our cybersecurity capabilities, we actively collaborate with third-party vendors. Notably, we engage a Managed Service Provider ("MSP") and another service provider who specializes in cybersecurity issues. Our MSP plays a critical role in supporting our IT infrastructure, offering expertise and resources that complement our in-house capabilities. The third party cybersecurity specialist provides advanced cybersecurity solutions, including continuous monitoring and threat detection services, which are integral to our cybersecurity program.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: • Reliable, Scalable Systems and Infrastructure Our information security systems, infrastructure, and processes are built on and follow the U.S. National Institute of Standards and Technology ("NIST") framework for information security, which is a set of guidelines, accepted standards, and best practices for mitigating organization cybersecurity risks published by NIST. We continue to make significant investments in industry-leading and advanced technologies as part of our strategy to strengthen our security posture, business continuity capabilities, and ability to protect and safeguard systems and stakeholder data. Our Information Security Program and systems are tested and assessed annually by an independent third party. • Automation and Artificial Intelligence We have implemented automated systems to proactively test attack vectors by emulating inside and outside threats resulting in the validation of our ability to detect and defend against a cyber attack. Artificial intelligence is used as part of early warning systems designed to detect, alert, and respond to potential cyber threats. • Training

companyName: BALCHEM CORP

ticker: BCPC


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operation."

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including penetration testing, third-party audits, and reassessing best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures and reports to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures and technologies.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our industry is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A, "Risk Factors," in this Annual Report on Form 10-K for additional information regarding the risks related to cybersecurity threats.

companyName: Marqeta, Inc.

ticker: MQ