text: Our Audit Committee has oversight of our cybersecurity risk processes, as part of its overall oversight of our risk management program. Our CFO is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the third party provider.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE

secItem: Item 1C


text: At a management level, our cybersecurity risk management program is led by our CIO, along with our Director, Information Security Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Director, Information Security Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These 11 technology professionals have an average cybersecurity tenure of 13 years and certifications from ISC2, ISACA, CompTIA and other industry certification leaders including CISSP, CISM, CISA, CCNA, CCNP, Network+, Security+, Project+, A+, CEH, CCSP and ITIL, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Company routinely engages third-party industry experts to perform risk assessments of the Program. At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity. The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the Audit & Risk Management Committee for input. The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.

companyName: SB FINANCIAL GROUP, INC.

ticker: SBFG


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.

companyName: COHERENT CORP.

ticker: COHR


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The General Counsel, Director of IT, and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.

companyName: Origin Materials, Inc.

ticker: ORGN


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which includes risks that arise from our use of AI, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks At an operating level, our cybersecurity program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO has over 20 years of information technology experience that spans architecture and design, governance, disaster recovery, department development, and risk identification and remediation. In addition, our CISO has over 25 years of cybersecurity experience with a skill set that includes incident and remediation management, company-wide training, and the creation and implementation of cybersecurity compliance programs that address administrative, physical, and technical safeguards.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: To educate our management, employees, and consultants, and mitigate the risk of human failure in exposing our Information Technology systems to cybersecurity threats from bad actors; management, employees, and consultants are required to complete on-line cybersecurity training annually. We also provide regular reminders to employees regarding suspicious emails or other communications and conduct periodic phishing simulations and remedial spot testing and training to reinforce recognition and response techniques.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Risk assessments are periodically conducted by our VP of Internal Audit. Internal audits are conducted and reported to the Audit Committee on a quarterly basis.

companyName: JFrog Ltd

ticker: FROG


text: To date, no cybersecurity threat, including from a cybersecurity incident, has materially affected our business strategy, results of operations, or financial condition.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity incidents or breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Our Executive Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: DURECT CORP


text: Currently, our CFO is responsible for hiring appropriate personnel, managing external third-party providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Our incident response plan coordinates the activities that we and our third-party information technology and cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain and remediate an incident, as well as to comply with potentially applicable legal obligations.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: The Evergy Companies utilize an enterprise risk management framework to identify, evaluate and minimize risks. Risk management personnel meet annually with subject matter experts and each board member to identify and assess enterprise risk and also confer with each board member about the Evergy Companies' risk management profile. Evergy's Board of Directors (Evergy Board) has assigned primary oversight of enterprise risk management practices to the Audit Committee of the Evergy Board. At least annually, the Audit Committee reviews and discusses with management the Evergy Companies' enterprise risk management policies, processes, and frameworks, including conclusions reached regarding risk assessment and risk management.

companyName: Evergy, Inc.

ticker: EVRG


text: Our management team, including our VPIT and DIS, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes extensive technology and finance leadership experience across multiple industries, experience in the Legal, Risk and Compliance disciplines, and over 20 years of cybersecurity leadership experience for our VPIT.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Cybersecurity Risk Management Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature.

companyName: CG Oncology, Inc.

ticker: CGON


text: Our Board of Directors oversees the cybersecurity risk management program and is regularly informed of cybersecurity risks through periodic updates provided by the Director of Information Technology ("IT"), to address our cybersecurity processes and risk mitigation efforts. Certain Board of Directors have cybersecurity risk certification credentials and experience with, and exposure to, cyber risk oversight. The periodic updates provided by management to the Board of Directors generally encompass emerging cyber threats, the Company's security posture changes, significant cybersecurity incidents, progress of risk mitigation efforts, and cybersecurity strategies and investments. The frequency of these updates allows for timely decision-making and ensures that our Board is fully informed of our cybersecurity risks.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management ("ERM") program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer ("CISO") responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.

companyName: KELLY SERVICES INC

ticker: KELYA


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents of a material nature. For additional information about the risks from cybersecurity threats, see "Item 1A. Risk Factors" in this Annual Report.

companyName: LendingClub Corp

ticker: LC


text: Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing businesses today. It results from intentional malicious attacks or unintentional acts that impact the confidentiality, integrity, or availability of our, our clients' or third parties' operations, systems, or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategies.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: The Audit & Finance Committee receives quarterly briefings regarding the Company's cybersecurity matters from our Chief Information Security Officer, who has primary management oversight of cybersecurity matters and reports to our Chief Information Officer. The topics reported by the Chief Information Security Officer include updates on the Company's cybersecurity threats, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party and internal assessments conducted. The full Board of Directors receives briefings on an as-needed basis from the Audit & Finance Committee or management, as applicable.

companyName: BERRY GLOBAL GROUP, INC.


text: We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security ("GIS") team has day-to-day responsibility for Spirit's cybersecurity program. This group is led by our Chief Information Security Officer ("CISO"), who has more than twenty years of relevant audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Executive Security Council comprised of senior leaders across the business meets regularly to discuss the company's overall cybersecurity strategy, policies, and key cyber risks and mitigations. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to help protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.

companyName: Spirit AeroSystems Holdings, Inc.


text: The Company reviews cybersecurity risks within their risk management function, which is led by our senior leadership team, including the Chief Legal Officer, Chief Financial Officer, and Vice President of Information Technology.

companyName: Medicine Man Technologies, Inc.

ticker: SHWZ


text: The Audit Committee of the Board of Directors is tasked with providing oversight related to cybersecurity topics. At least quarterly, the Audit Committee receives a report of any cybersecurity incidents and other key monitoring metrics from a representative of the Cybersecurity Steering Committee. For each incident, the Audit Committee is briefed on the nature of the incident, points of vulnerability, scope of the incident, and the Company's response. The Audit Committee will then communicate cyber-related issues with the Board as needed. Our Board monitors our existing cybersecurity program and related policies, including, among other things, the Board's role within our cybersecurity risk management infrastructure.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: At Papa Johns, the Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") through its Audit Committee and implemented and managed by the Company's Cyber Oversight Group, a cross-functional team of senior management.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Our Board of Directors ("Board") oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure to our strategic objectives. While the Board reviews the Company's cybersecurity program annually, the Nominating, Governance, and Risk Committee of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate. The Nominating, Governance, and Risk Committee is scheduled to have regular updates on cybersecurity matters from our Chief Information Security Officer ("CISO") and members of the CISO's team at least two times per year. The CISO will discuss management's actions to identify and detect threats and review the structure of and enhancements to the Company's defenses as well as management's progress on its cybersecurity strategic roadmap. The Nominating, Governance, and Risk Committee Chair reports back to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.

companyName: INSULET CORP

ticker: PODD


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: When detected, suspected cybersecurity threats are escalated to the CIO and incident response team. The CIO then creates a Cybersecurity Incident Response Team ("CSIRT") which, depending on the incident, comprises the incident coordinator, cybersecurity staff, legal counsel and other stakeholders as appropriate. The CSIRT investigates and manages the impact of cybersecurity incidents in accordance with our security incident response procedures.

companyName: Sotera Health Co

ticker: SHC


text: Our board of directors is actively engaged in the oversight of our global cybersecurity program. Our board of directors receives regular, quarterly reports on these matters from our CSO and leadership from our global product and technology organization, including on the status of projects to strengthen the Company's cybersecurity systems and improve cyber readiness, as well as on existing and emerging threat landscapes. In addition, the corporate development & technology committee of our board of directors receives regular, quarterly reports on our global product security and resiliency program led by leadership from our global product and technology organization with assistance from our CSO. Concurrent and in addition to these reports, our chief administrative officer ("CAO") (who oversees legal, security and compliance matters) provides a legal, regulatory and ethics update at each meeting of the audit committee of our board of directors, which includes matters of cybersecurity, as appropriate. In addition, important actual or emerging cybersecurity events are communicated to the board of directors by our CAO and Chief Legal Officer, even if immaterial to us.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Our board of directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the board of directors. We have implemented a process for our Information Security Coordinator, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: Managing Material Risks & Integrated Overall Risk Management Prosper has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our information security ("InfoSec") team works closely with our information technology team to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: PROSPER MARKETPLACE, INC


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: LXP Industrial Trust

ticker: LXP


text: Our Vice President, IT Security is an experienced cybersecurity professional with more than 10 years of experience building and leading cybersecurity, risk management, and information technology teams, and holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.

companyName: SANMINA CORP

ticker: SANM


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition or are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement security measures adequate to prevent cybersecurity incidents or fully mitigate their impact. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors".

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: We believe that cybersecurity is fundamental to how we operate and as such we focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.

companyName: GXO Logistics, Inc.

ticker: GXO


text: The Company's information security program is designed with the goal of maintaining the safety and security of our systems and data and we employ a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our board of directors.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: This plan includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial records and transactions, and maintain the confidentiality of our customers' data.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been largely mitigated by preventative, detective and responsive measures implemented by us. For a detailed discussion of our cybersecurity related risks, see Item 1A Risk Factors – "A breach in the security of personal information, breach in credit card data or system disruptions caused by security breaches or cyberattacks – including attacks on those parties we do business with – could harm our ability to conduct our operations and could have a material adverse effect on our financial position or results of operations."

companyName: Allegiant Travel CO

ticker: ALGT


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: We have implemented an information security management system in accordance with our risk profile and business that is designed to protect the Company, our employees, and our shareholders from cybersecurity threats. We have also developed an incident response policy and procedure designed to facilitate the handling of cybersecurity incidents.

companyName: DevvStream Corp.

ticker: DEVS


text: The Chief Information Security Officer ("CISO") and the information security team that reports to the CISO help identify, assess and manage our cybersecurity and privacy threats and risks, including through the use of our external and internal risk assessments. The CISO and the information security team identify and assess risks from cybersecurity threats by monitoring and evaluating our networks, data and our risk profile using various methods including, among other things, manual tools, automated tools, analyzing reports of threats and actors, conducting scans of the computer networks, internal and/or external audits (including compliance audits with respect to ISO (27001, 27017, 27018, and 27701) for our corporate and cloud based software solutions and SOC 2, PCI DSS and HIPAA with respect to our cloud based software solutions), conducting assessments for potential internal and external threats, third-party-conducted risk assessments, conducting vulnerability assessments, third-party-conducted red/blue team testing and tabletop incident response exercises and subscribing to reports and services providing cybersecurity threat intelligence.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Management participates in discussions and updates the Audit Committee, as necessary, regarding any material cybersecurity incident as well as incidents with lesser potential impact. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk program on an as-needed basis. Members of our Board of Directors receive presentations on cybersecurity topics from our Chief Information Security Officer, internal staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: Beauty Health Co

ticker: SKIN


text: We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.

companyName: GameStop Corp.

ticker: GME


text: Particularly, we had established a dedicated management standard for information security and cyber-security titled "Aomi APP Production Environment Anomaly Handling Guideline W-OM-CZ-001" ("Guideline") since August 2020. This Guideline provides detailed definitions of incident levels, operational processes, anomaly handling workflows, review requirements, and a list of emergency response personnel. Since its formulation in 2020, we have adhered to these guidelines.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: The ISO manages our security vendor risk management program. Each vendor's cybersecurity risk is ranked using a risk tiering calculator. The calculator is designed to provide a consistent methodology for evaluating key risk factors, such as the type of service or product the vendor provides and the location and classification of data. For high- and moderate-risk vendors, an assessment is completed that includes reviewing external audits and certifications (e.g., SOC 2 Type 2 audit, ISO 27001 and associated Statement of Applicability, FedRAMP authorization). As needed, an industry-standard questionnaire is completed by the vendor and the results assessed by ISO in an effort to ascertain information security maturity and overall posture. High-risk vendors are re-evaluated annually while moderate-risk vendors are evaluated every three years. Ongoing monitoring is in place for all high, moderate, and low risk vendors using an external service that rates the cybersecurity posture of corporate entities using a scored analysis of cyber threats.

companyName: MAXIMUS, INC.

ticker: MMS


text: We maintain a cybersecurity risk management program based upon the National Institute of Standards and Technology Cybersecurity framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care, and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Trust, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Trust does not have any directors, officers, or employees. The Sponsor, an indirect, wholly owned subsidiary of The Goldman Sachs Group, Inc. ("Goldman Sachs) and an affiliate of Goldman Sachs & Co. LLC, generally oversees the performance of the Trustee and the Trust's principal service providers. The Trustee in turn is generally responsible for the day-to-day administration of the Trust. The Sponsor and the Trust rely on Goldman Sachs' cybersecurity policy, which also applies to the Trust. The Sponsor and the Trust also rely on the systems of GS Group Inc., its third-party service providers, and the Trust's service providers.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. As part of the Board's oversight, the Board will receive a report at least annually from our cybersecurity committee, covering updates on our cybersecurity risks and threats, the status of projects intended to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape.

companyName: Aeries Technology, Inc.

ticker: AERT


text: We place a high priority on securing confidential business information and the sensitive personal information we receive and store about our consumers, customers and employees. We have systems in place to securely receive and store that information and to detect, contain, and respond to cybersecurity incidents. We also have processes to manage risk from cybersecurity threats associated with third parties, including service providers, such as risk assessments and contractual requirements that include cybersecurity measures. In addition, we have a cybersecurity and information security training and compliance program in place to support our teams who work in areas of cybersecurity and information security risk. As part of this program, VF employees who have access to confidential information receive training at least annually on cybersecurity and information security. To respond to the threat of security breaches and cyberattacks, VF maintains a program, overseen by VF's CISO and COO, that is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by, or in the care of, VF. This program also includes a cyber incident response plan that provides processes for timely and accurate reporting of any material cybersecurity incident. Our CISO has over thirty years of experience as a cybersecurity professional, including experience as the CISO of two large retailers, and reports to our COO, who leads our digital and technology functions and has nearly twenty years of experience enabling digital transformation for global companies. In addition, members of VF's information security, IT and privacy teams have broad experience and expertise in selecting, deploying and operating cybersecurity technologies, initiatives and processes around the world. VF also engages service providers, consultants and other third parties in connection with these processes to provide augmented cybersecurity capabilities, deliver strategic advice, provide assurance regarding the effectiveness of certain processes and assist in cybersecurity incident response efforts, as needed. VF also maintains a cybersecurity risk insurance policy.

companyName: V F CORP

ticker: VFC


text: The Board of Directors of the Company provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") provide annual written reports and quarterly briefings on the Company's cybersecurity program to the Board of Directors. They also provide quarterly cybersecurity updates to the Audit and Compliance Committee. The reports to the Board of Directors include details and metrics on, among other things, the Company's quarterly Cybersecurity Framework assessment updates, internal and external threat intelligence, quarterly information security program progress, business associate risk assessments and ongoing monitoring, company-wide awareness training, device security compliance, routine resilience efforts including disaster recovery exercises, tabletop security incident response exercises, and cyber penetration tests.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: Company management meets as needed with relevant employees of the Manager to discuss cybersecurity risks and incident trends and escalates them, as appropriate, to the Audit Committee.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: We rely on the cybersecurity strategy and policies implemented by Oaktree. Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment. The audit committee of the board of directors of Brookfield Oaktree Holdings, LLC oversees Oaktree's cybersecurity program. The cybersecurity team briefs the audit committee of Brookfield Oaktree Holdings, LLC on the effectiveness of Oaktree's cyber risk management program. The Internal Audit team also shares the results of its annual cybersecurity audits with the audit committee of Brookfield Oaktree Holdings, LLC.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: The Board of Directors established its Risk Committee with specific responsibility for overseeing risks from cybersecurity threats, among other things. Our Vice President of Global Information Security provides the Risk Committee periodic reports on our cybersecurity risks and any material cybersecurity incidents. In addition, our cybersecurity team provides annual reports to our Board of Directors.

companyName: LCI INDUSTRIES

ticker: LCII


text: We leverage third party service providers and solutions in many aspects of our operations. Our vendor management and oversight procedures include assessment of cyber security risk.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We believe cybersecurity is critical to advancing our technological advancements. As a fintech company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Netcapital Inc.

ticker: NCPL


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, penetration and vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties, including consultants and outside monitoring agencies, to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee during management's annual update to the Audit Committee and the Board, and the Company updates and adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors. Depending on the environment, as part of our security program, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Sprout Social, Inc.

ticker: SPT


text: The Board of Directors receives regular reports from the Senior Vice President, Director of Information Technology and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: We have a multi-functional incident response plan which provides guidance in the event of a cybersecurity incident. The plan is managed by our Incident Management Team, which includes representation from our Global Security, Cybersecurity, Legal, and Finance departments, among others. The Incident Management Team is responsible for responding to an incident, including tasks such as identifying and assessing the nature of the incident, containing the incident, and coordinating with relevant departments. Depending on the nature or severity of the event, the Incident Management Team may escalate the matter to our Executive Leadership Team, which includes the Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and other executives. If necessary, the matter could be escalated to our Board of Directors or any appropriate Board committees, including the Audit Committee, which has oversight responsibility for cybersecurity risk. This structured governance approach is designed to manage cybersecurity incidents with participation and involvement with the appropriate levels of our organization.

companyName: HERBALIFE LTD.

ticker: HLF


text: The World Gold Council has an incident response plan ("IRP") which (i) identifies the incident response team and the roles and responsibilities of the team members, (ii) details the incident response lifecycle, including preparation, detection, response and recovery, and (iii) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact the Trust to be reported to the Principal Financial and Accounting Officer of the Sponsor.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Our CISO reports directly to our executive management team and advises Synopsys on cybersecurity risks and assesses the effectiveness of information technology and data security processes. The materials presented to our Board and CGN Committee include updates on our data security posture, results of third-party assessments, progress towards pre-determined risk-mitigation related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Board and the CGN Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and to discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks may also be considered during separate Board meeting discussions.

companyName: SYNOPSYS INC

ticker: SNPS


text: any significant cybersecurity attacks and, to date, the risks from cybersecurity threats have not materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For more information regarding the risks the Company faces from cybersecurity threats, see "Item 1A. Risk Factors––Risks Related to Our Business and Operations––We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks."

companyName: Tenon Medical, Inc.

ticker: TNON


text: We are regularly audited by various internal and external bodies that validate compliance with regulatory requirements and industry standards. We perform periodical internal assessments of the design and operating effectiveness of our cybersecurity controls, including penetration testing. Dedicated cyber teams in each division and at the Group level perform assurance activities against the Flutter cyber risk and control framework. A dedicated, independent IT internal audit team performs several audits each year on a risk-based approach to key and changing cyber risks. Internal audit's audit plan frequently covers cyber domains such as: patch and vulnerability, cyber threat management, security incident management, access management, network security, data loss prevention and business continuity planning. Agreed improvements are tracked through to completion.

companyName: Flutter Entertainment plc

ticker: FLUT


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the company, and reports to the EVP of Microsoft Security. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Before joining Microsoft, our CISO served in a prior Chief Technology Officer role as well as in senior leadership, engineering, and operational roles within multiple organizations. In addition to the Board's oversight of cybersecurity risk, to support the CISO, we have established a Cybersecurity Governance Council ("CGC") charged with overseeing initiatives that safeguard Microsoft's infrastructure. The CGC is comprised of an executive-level team of Deputy CISOs with cybersecurity backgrounds and expertise relevant to their roles. The CGC responsibilities include approving our enterprise security risk assessment process and results, determining the appropriate cybersecurity risk level and mitigations, reviewing the NIST CSF alignment, and supporting compliance with cybersecurity regulations. Our cybersecurity efforts are supported directly by Microsoft's security and threat intelligence experts and our employees across the company, all of whom receive cybersecurity awareness training and education and are expected to support our efforts.

companyName: MICROSOFT CORP

ticker: MSFT


text: The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.

companyName: Ellington Financial Inc.

ticker: EFC


text: We maintain a cybersecurity program and incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: The CISO provides quarterly reports to the Audit Committee, as well as more frequent reports to our Chief Executive Officer and other members of our senior management. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and the emerging threat landscape. Our cybersecurity program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: We work with third-party service providers that proactively assess our information security program and provide us with an industry view of the cyberthreat landscape, in addition to monitoring and supporting our control environment and breach notification and response processes.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: At each regular quarterly meeting of the board enterprise risk committee, the cybersecurity subcommittee reviews a summary of the information discussed in the most recent cybersecurity subcommittee meetings. The board of directors has determined that cybersecurity is a priority area of focus and regularly engages with the CISO and other members of senior management in substantial discussions in board and committee meetings to address cybersecurity topics relating to risk management, compliance, strategy, innovation, and governance. Material cybersecurity threat risks are also considered during separate board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, business transactions and acquisitions, and brand management.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: The operating systems of Federated Hermes, and its offerings, customers, shareholders, and service providers are dependent on the effectiveness of information security policies and procedures (both at Federated Hermes and at third parties, such as its service providers) which seek to ensure that such systems are protected from cybersecurity incidents. Federated Hermes has established a robust cybersecurity program aimed at assessing, identifying and managing material risks from cybersecurity threats.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: We employ a comprehensive strategy for identifying and addressing cybersecurity risks that is aligned with the U.S. Department of Commerce's National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity. This framework outlines standards and practices to promote the protection of critical infrastructure. We utilize a risk-based approach that focuses on critical systems where failure or exploitation could potentially impact the safety or reliability of our key assets or operations. Cybersecurity risks are integrated into our overall risk management processes, including, for example, quarterly security briefings with senior management, tabletop exercises with operations, finance and other company personnel, and by employing a continuous improvement model for our cyber protection strategy that is aligned with the DHS's National Infrastructure Protection Plan risk management framework.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications.

companyName: Kandi Technologies Group, Inc.


text: We recognize the critical importance of maintaining the confidentiality, integrity and availability of our information systems and data, and of effectively assessing, identifying and managing cybersecurity and related risks. Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk. It is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee, and our Board of Directors (Board). The underlying controls for the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology and the Center for Internet Security Benchmark.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: The Company has established and maintains a comprehensive information security incident management plan (the "Plan") that allows the Company to respond quickly and effectively to cybersecurity threats and cybersecurity incidents, including cybersecurity breaches, in accordance with applicable laws and regulations.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: to manage the risk assessment and mitigation process. We monitor and test our safeguards and train our employees on the implementation of such safeguards, in collaboration with human resources, IT, and management. We aim to promote a company-wide culture of cybersecurity risk management.

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board of Directors periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.

companyName: Weatherford International plc

ticker: WFRD


text: The VP of IT has a monthly meeting with the Company's President to provide an update of cybersecurity incidents and risks, irrespective of materiality. The Company's Board of Directors is provided a quarterly update on cybersecurity roadmaps and progress.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third party research institution collaborators, CROs, CDMOs, or other contractors or consultants, may fail or suffer cyberattacks or security breaches."

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: of Directors and Audit Committee delegated authority from our Board of Directors and in accordance with its charter, our Audit Committee is charged with the oversight of enterprise risk, including risk related to cybersecurity threats. Our Audit Committee Chair is expected to report regularly to our Board of Directors about our Audit Committee's oversight of enterprise risk. Beginning in 2024, our Audit Committee Chair will report quarterly to our Board of Directors specifically about our cybersecurity incident management and governance.

companyName: MICROVISION, INC.

ticker: MVIS


text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Senior Vice President and General Counsel, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.

companyName: Nine Energy Service, Inc.


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our board of directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program. The Audit Committee receives regular updates from management on the effectiveness of our cybersecurity program, reviews plans on how management will continually advance the program, and receives updates on special topics that help the committee provide effective oversight of the program.

companyName: TORO CO

ticker: TTC


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 10 years.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: Use of Independent Experts The Company engaged an independent expert to conduct annual external and internal penetration tests beginning in the fourth quarter of 2021 and to assess our cybersecurity program against the NIST CSF in late 2022. We plan to continue to engage independent experts to periodically test our cybersecurity policies for their effectiveness.

companyName: Sotera Health Co

ticker: SHC


text: IDACORP and Idaho Power include risks from cybersecurity threats, including from use of third-party service providers, as part of the companies' enterprise risk assessment process. The companies have utilized and continue to utilize recognized third-party cybersecurity standards such as those published by the Center for Internet Security and the U.S. National Institute of Standards and Technology in developing their risk management framework for cybersecurity, their cybersecurity processes, controls, and procedures, and risk identification. The companies engage with consultants and other third parties as necessary to design, enhance, and implement appropriate cybersecurity measures in seeking to mitigate risks from cybersecurity threats. As part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers, the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.

companyName: IDACORP INC

ticker: IDA


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, as well as confidential information that is proprietary, strategic or competitive in nature.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: Risk Management and Strategy BD's cybersecurity risk management program is focused on maintaining the confidentiality, integrity and availability of BD products, manufacturing and distribution operational technology ("OT"), enterprise IT and BD data. We incorporate cybersecurity risk management into our systems and processes, which we strive to align with multiple industry-leading cybersecurity standards, including the Joint Security Plan issued by the Health Sector Coordinating Council for BD products and guidelines issued by the National Institute of Standards and Technology (NIST) for our manufacturing and distribution OT and enterprise IT.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: In maintaining these measures, we consider certain principles from recognized frameworks, such as those published by the Committee of Sponsoring Organizations of the Treadway Commission, the International Organization for Standardization, and other applicable industry standards. Our approach to addressing cybersecurity risk is cross-functional and is designed to preserve the confidentiality, integrity, and availability of data by identifying, preventing, and mitigating cybersecurity incidents.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: At Meta, cybersecurity risk management is an important part of our overall risk management efforts. Our industry is prone to cybersecurity threats and attacks, and we regularly experience cybersecurity incidents of varying degrees. We believe we are a particularly attractive target as a result of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. Our products and services reach billions of users and involve the collection, storage, processing, and transmission of a large amount of data. In addition, our business and operations span numerous geographies around the world, involve thousands of employees, contractors, vendors, developers, partners, and other third parties, and rely on software and hardware that is highly technical and complex. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Meta Platforms, Inc.

ticker: META


text: The Board of Directors oversees risk management and compliance generally, including information security and cybersecurity. The Audit Committee of our Board of Directors has primary responsibility for supervising our cybersecurity program on behalf of the Board consistent with the requirements of its charter, including with respect to risk management, risk assessment, oversight of management's activities and expertise, and disclosure controls and procedures; however, the full Board is briefed regularly throughout the year. As part of the cybersecurity oversight by the Audit Committee and our Board of Directors, our CAO provides formal reports to the Board (including to all members of the Audit Committee) at least quarterly. These reports include updates on our cyber risks and threats, information security systems, and information security program. In addition, our CAO and CISO also meet directly with members of the Audit Committee on an ad hoc basis to discuss and seek guidance on our cybersecurity program.

companyName: VERINT SYSTEMS INC


text: We use a comprehensive due diligence process to manage third-party risks, emphasizing continuous monitoring and to ensure our business partners' cybersecurity practices meet our stringent standards.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: In the last three fiscal years we have not identified any material cybersecurity incidents and have not identified any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the expenses we have incurred from any cybersecurity incidents over the last three fiscal years were immaterial. Furthermore, we have not been penalized or paid any amount under an information security breach settlement in the last three fiscal years. There can be no guarantee that we will not experience such an incident or incur such expenses in the future. For more information on our cybersecurity risks, see "Technology Risks" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.

companyName: MSCI Inc.

ticker: MSCI


text: The CIO has been in his role at Williams for over 10 years and has over 30 years of combined Information Technology experience with a broad scope of responsibility. He has provided senior leadership support of the cybersecurity and risk management programs since 2013. Our CIO holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: CORPAY, INC.

ticker: CPAY


text: Our Board monitors cybersecurity risk as part of GECM's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Despite our continuing efforts, however, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."

companyName: Skillsoft Corp.

ticker: SKIL


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management ("TPRM") program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Recognizing the importance of human factors in cybersecurity, we provide regular employee training that emphasizes common threats, such as phishing, social engineering, sensitive data exposure, and insider risks. In addition to regular training sessions, we perform phishing simulations, post security bulletins, and provide dedicated means for employees to report attempted threats.

companyName: ARGAN INC

ticker: AGX


text: Our management team is responsible for day-to-day assessment and management of cybersecurity risks. On our management team, our Chief Financial Officer, or CFO, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees, customers, vendors and other individuals to address cybersecurity risks. Our CFO has approximately 10 years of experience managing information technology teams of operating companies in the biotechnology industry. Our CFO leads a cross-functional Cybersecurity Committee, consisting of executive-level leaders and other management-level individuals with the requisite skills and education, that assists the CFO with carrying out these duties. Collectively, the members of our Cybersecurity Committee have notable experience in managing information security, possess the education and skills to fulfill these duties, and attend periodic trainings as necessary.

companyName: OCULAR THERAPEUTIX, INC

ticker: OCUL


text: Our Director of IT has over 25 years of experience in IT and has a proven track record of creating, implementing, and managing successful infrastructure security, business continuity, access management, and change management policies and programs.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, which includes our management of information and cybersecurity risk. The full Board receives an update on our cyber risk management process and trends related to cybersecurity at least annually, or real-time if a material event occurs. The Audit Committee of the Board assists the full Board in its oversight of cybersecurity risks. As part of its oversight, the Audit Committee receives regular reports from management on information systems and security, including metrics and controls at each meeting, and other items at least annually including risk assessments, security software, incident response plans, and key updates to the cybersecurity program and its effectiveness.

companyName: SMITH A O CORP

ticker: AOS


text: The identification of control weaknesses and vulnerabilities affecting information assets and/or relationships with third parties allows the Company to mitigate risk from, and respond to, cybersecurity threats. Initial risk assessments are performed upon the acquisition, or as part of the development of, information assets in order to evaluate the inherent risk associated with network and host environments and assess the adequacy of implemented technology operation processes and controls. Risk and control self-assessments are conducted on an annual basis to identify gaps resulting from any process changes that occurred during the year, and to evaluate whether the levels of cybersecurity risk remain within the tolerance set in the Company's Risk Appetite Statement or whether a risk needs to be mitigated.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Board of Directors of our parent company, WHLR, has primary oversight over cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of WHLR's Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors of WHLR regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to WHLR's Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: The Company also maintains several processes intended to safeguard our information systems, protect the integrity of our data and respond to cybersecurity incidents. These processes include a formal information security training program for all employees, training on matters such as phishing and email security best practices, annual disaster recovery exercises, targeted access controls, and multi-factor authentication logins. The Company maintains a cybersecurity incident response process to help ensure a timely and consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: The Company's cybersecurity risk management relies on a multidisciplinary team, including its information technology and cybersecurity team, legal department, executive management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. In 2023, the Company expanded its team by adding a full-time Chief Information Security Officer (CISO), reporting directly to the Chief Operating Officer, responsible for managing the internal and external cybersecurity resources. The CISO has over 30 years of experience in corporate enterprise infrastructure and data security management held at a senior management level, acting in both a corporate as well as consulting role within many highly regulated industries. The CISO is responsible for having successfully developed and implemented several cyber security programs within prominent companies within the retail, financial and life science sectors.

companyName: Veris Residential, L.P.


text: Our ERM program is overseen by a group of proficient individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: The CISO, through Exelon's Cyber Information and Security Services (CISS), reviews external and internal sources to obtain cyber threat intelligence to develop strategic and tactical threat assessments that inform the enterprise-wide cyber risk mitigation programs and actions. Exelon uses a wide range of tools, including endpoint, anomaly and network detection, logging and monitoring of security events, network segmentation, firewalls, hardening and securing devices, cyber vulnerability detection and patch management, cyber threat hunting, malware forensic analysis, industry-specific reports, and tabletop exercises to inform the cybersecurity management team. Exelon protects assets critical to grid reliability and national security through the implementation of the North American Electric Reliability Corporation's Critical Infrastructure Protection requirements, and gas pipeline security under the U.S. Department of Homeland Security's Transportation Safety Administration's Security Directives. Exelon maintains security relationships with law enforcement and U.S. intelligence agencies, coordinates with the Electricity Information Sharing and Analysis Center (E-ISAC) and participates in the Department of Energy's Cybersecurity Risk Information Sharing Program (CRISP) to strengthen the security of the energy grid, share information, design and participate in drills and exercises such as the bi-annual Grid Security Exercises and facilitate cross-sector coordination. Exelon applies stringent employee and contractor screening, and advances security awareness through training and monitoring programs that address both cyber and physical threats. Exelon employees are subject to annual mandatory training addressing security awareness, including cybersecurity and phishing. Exelon maintains cyber insurance coverage at limits consistent with the utility industry and reviews policy coverage and limits on an annual basis.

companyName: EXELON CORP

ticker: EXC


text: The Board of Directors provides oversight of Urban One's cybersecurity risk management efforts. The Board receives updates from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") on key cybersecurity risks, threat trends, and mitigation strategies. These updates are based on internal security monitoring and reporting, as well as insights from our managed security service provider ("MSSP").

companyName: URBAN ONE, INC.

ticker: UONE


text: We may also face litigation, investigations, or enforcement actions by governmental authorities, customers, shareholders, or other parties arising from any cybersecurity breaches or incidents.

companyName: Mitesco, Inc.

ticker: MITI


text: Key to the Audit Committee's role is its periodic engagement with our cybersecurity team, as further described below, which provides direct communication and alignment on cybersecurity matters between members of our board and management. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to potential cybersecurity incidents. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to focus on compliance and adaptation of our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Employee Security Awareness and Training: Information regarding our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: As of December 31, 2023, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition, although we may be materially affected in the future by such risks or future material incidents. See "Risk Factors—Risks Related to Our Business Operations—Disruption, failure or cyber security breaches affecting or targeting computers and infrastructure used by us or our business partners may adversely impact our business and operations" for additional information regarding cybersecurity risks.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: We take a risk-based approach to cybersecurity aligned with National Institute of Standards and Technology (NIST) Cybersecurity Framework principles and have implemented controls throughout our operations that are designed to address cybersecurity threats and incidents. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; and (v) managing third-party risks. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Governance - management's responsibility The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity controls designed to address cybersecurity threats and risks. The Chief Information Officer (CIO), who is a member of the Company's Executive Committee, and the Chief Information Security Officer (CISO) are responsible for assessing and managing cybersecurity risks, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: The DISO also administers the Incident Response Team ("IRT") and its members, which is comprised of various high-ranking executive personnel such as the Chief Audit Officer, Chief Compliance Officer, General Counsel, and representatives from Technology, Operations, Accounting and Corporate Communications. Members of the NBT IRT have extensive knowledge regarding the security protocols, operational processes and IT infrastructure for the Company. This allows cross-functional response efforts in the detection, mitigation and prevention of a cybersecurity incident suffered by the Company or its third party service providers. Upon detection of an incident, the IRT promptly convenes and updates executive leadership to assess its severity level, categorizing it as low, moderate, or high. The Company actively performs simulations and tabletop exercises at a management level and incorporates external resources as needed to stay current to cyber threat vectors. The Incident Response Plan also maintains procedures and escalation protocol to escalate significant cybersecurity matters to the Executive Committee, RMC and/or full Board, as deemed necessary.

companyName: NBT BANCORP INC

ticker: NBTB


text: The Corporation conducts periodic testing of software, hardware, defensive capabilities, and other information security systems utilizing both internal processes and third-party consultants. Testing procedures are supplemented by regular cyber threat exercises and employee training. Threat simulation exercises are used to develop and refine the Corporation's incident response plans and employees undergo cybersecurity awareness training on a regular basis.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including (i) our CTO, Mr. Leibel, who has previously served as the Senior Director of Engineering at various large technology companies and holds a Master of Information Technology degree from Virginia Tech; and (ii) our Vice President of Information Technology and Security, Mr. Brendan Hamilton, who has previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues and is a Certified Information Systems Security Professional.

companyName: Xometry, Inc.

ticker: XMTR


text: a multi-disciplinary security team overseen by our Information Security Council, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We know that people are often the most vulnerable element in an IT ecosystem. We work with team members at all levels to educate them about evolving risks, from well-known tactics and scams (e.g., phishing) to their more sophisticated descendants (e.g., vphishing, spear phishing and smishing). Team members receive training on data security and privacy practices and are included in periodic awareness campaigns to test real-world responses. We are on the lookout for additional training opportunities and have recently begun scheduling "tabletop" exercises to test our PCI-related responses and creating new business interruption plans. The Company also employs and enforces a number of policies to guide team member behavior and help protect against threats, covering everything from regular password updates to obtaining permission to install third-party programs and use personal devices. Team member training reinforces the Company's risk management policies and procedures and the expectation that all team members will adhere to them.

companyName: Portillo's Inc.

ticker: PTLO


text: The CISO also promptly informs and updates the Board about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The Audit and Finance Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Board. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, receives periodic reports from the IT Director regarding cybersecurity objectives and risk management measures being implemented by the Company and discusses these updates to identify and mitigate data protection and cybersecurity risks. The cybersecurity objectives established by the IT Director are based on industry best practices and are designed to further develop the security IT infrastructure.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: The Fund has processes in place designed to assess, identify, and manage material risks from cybersecurity threats. The Fund's business is dependent on the communications and information systems of the Investment Adviser and other third-party service providers. The Investment Adviser manages the Fund's day-to-day operations and has implemented a cybersecurity program that applies to the Fund and its operations.

companyName: John Hancock Comvest Private Income Fund


text: We have processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board, primarily through its audit committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct risk assessments of certain third-party providers before engagement and have established monitoring procedures in an effort to assess and mitigate potential data security exposures originating from third parties. We from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: RYVYL Inc.

ticker: RVYL


text: In 2019, our board of directors established a standing Cybersecurity Committee, which is tasked with oversight of the Cybersecurity Program, including: (i) strategy and governance; (ii) operations; and (iii) risk management and regulatory compliance.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We have implemented cybersecurity tools, conducted employee training, and monitored emerging laws and regulations related to data protection and information security. We may also [obligate] certain third-party business partners to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect the Company.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security, including cyber security and back-up of information systems, and the steps the Company has taken to monitor and control such exposures and the responsibility to confer with management and the Company's auditors the adequacy and effectiveness of the Company's information and cyber security policies and the internal controls regarding information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least twice each year.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: Our Enterprise Risk Committee has delegated to our Chief Information Officer primary responsibility for identifying, assessing and managing cybersecurity-related risks. Our Chief Information Officer has a Bachelor of Science in Computer Science from the University of Kentucky and a Master of Business Administration in Finance from the Wharton School of Business at the University of Pennsylvania. He has served in his current role at EQT since 2019 and has over twenty years of information technology experience within the energy industry.

companyName: EQT Corp

ticker: EQT


text: The cybersecurity program is overseen by the Chief Information Security Officer ("CISO") reporting into the Chief Risk Officer ("CRO"), the Enterprise Risk Management Committee, which consists of the CEO, CFO, and CTO among others, and the Enterprise Risk Committee of the Board of Directors, which consists of three independent directors. Our Board of Directors includes members who have expertise in cybersecurity, data privacy law, fraud and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO, who has extensive experience in the Information Technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's extensive knowledge and experience in the cybersecurity field are critical to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards, and Disaster Recovery, Business Continuity, and Incident Response efforts. Additionally, the Bank's Risk Management function is led by the CRO, who has extensive experience in risk management and audit. The cybersecurity program includes a cross-sectional team of internal and external Information Security professionals, all of which are provided with relevant training and are required to maintain industry accredited certifications. Our Incident Response Team is chaired by our CISO and is comprised of executive management and designated managers throughout the organization. The purpose of the Incident Response Plan is to manage Information Security, and related incidents, efficiently and effectively to minimize loss and destruction, mitigate weaknesses, restore services, and notify customers, as required by state law, comply with regulatory requirements, and any third-party contractual obligations.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: As part of the Board's oversight of risk management, the Board reviews our cyber-risks with management and the actions we are taking to mitigate such risks. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for employees. Board oversight of risk is also performed between meetings through the Audit Committee and communications between management and the Board. The Board receives periodic education around cybersecurity risks and best practices.

companyName: W. P. Carey Inc.

ticker: WPC