text: • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • An information training and awareness program for our employees, contractors, incident response personnel, and senior management; and • A third-party risk management framework designed to monitor and address risks from cybersecurity incidents of service providers, suppliers, and vendors that includes due diligence over third-party's information security and technology control environment at onboarding and periodically throughout the lifecycle of the relationship. In addition, our standard contractual terms require notification and communication from third parties in the event of a cybersecurity incident. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Glen Burnie Bancorp maintains a cyber risk management program that is designed to prevent, detect, and respond to information security threats. The Board of Directors is responsible for oversight of the Company's information security program, which is designed and implemented by management under the direction of the Senior Vice President, Director of Information Technology. In addition, the Internal Auditor, Information Security Officer, and Compliance Officer consider cybersecurity threat risks alongside other company risks as part of our overall risk assessment and management process.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ

secItem: Item 1C


text: We maintain technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets. If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.

companyName: LXP Industrial Trust

ticker: LXP


text: Our Cybersecurity Governance Committee includes our Chief Financial Officer, Chief Operating Officer, General Counsel, Senior Director of IT, Director of IT, Senior Director of Software, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. We believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.

companyName: FTC Solar, Inc.

ticker: FTCI


text: The IT department's personnel have extensive backgrounds in IT operations in similar environments and each team member has had experience managing cybersecurity issues.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: We subscribe to multiple feeds and associations that discuss and monitor risks of any technology compromise at our business partners where relevant. Relevant restaurant level personnel and employees at the restaurant support center receive periodic training to bring awareness on how they can help prevent and report potential cybersecurity incidents. We also provide credit card handling training following Payment Card Industry guidelines to team members that handle guest payment information. In addition, key stakeholders involved with our cybersecurity risk management programs receive additional training and regularly participate in scenario-based training exercises to support the effective implementation of our programs. We maintain a disaster recovery plan and protect against business interruption by backing up our major systems. We routinely scan our environment for any vulnerabilities and perform penetration testing. In addition to our internal processes and controls, we engage multiple third-parties to assess the effectiveness of our data security practices, including through an annual risk assessment. We conduct annual cybersecurity audits using a reputable third-party security auditor. A third-party conducts regular network security reviews, scans and audits. We require third-party vendors and service providers to complete a security questionnaire or provide a security compliance report performed by a reputable third-party to assess their risk.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. For additional information regarding risks we face, please refer to "We may not be able to prevent, or timely detect, information technology security breaches" in Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes.

companyName: Westrock Coffee Co

ticker: WEST


text: While we dedicate resources and efforts to our cybersecurity program, we may be unable to successfully identify threats, prevent attacks, satisfactorily resolve cybersecurity incidents, or implement adequate mitigating controls. Any breach of our network security and information systems or other cybersecurity-related incidents that results in, or may result in, the loss, theft or unauthorized disclosure of data, or any delay in determining the full extent of a potential breach, could have a material adverse impact on our business, results of operations, and financial condition, including harm to our reputation and brand, reduced demand for our solutions, time-consuming and expensive litigation, fines, penalties, and other damages. To date and except as otherwise may be noted in this Annual Report, we do not believe that any cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information relating to cybersecurity risks and uncertainties, please see the risk factor entitled "Cybersecurity incidents may have a material adverse effect on Veea's business, operations, financial performance, customer and vendor relationships, reputation and brand." in Part I, Item 1A, and other risk factors in this 10-K.

companyName: VEEA INC.

ticker: VEEA


text: Cybersecurity and Risk Mitigation Our cybersecurity policies are guided by standards or recommendations issued by, among others, the National Institute of Standards and Technology, the International Organization for Standardization, the NRC, and NERC. We deploy, configure, and maintain technologies and procedures designed to enforce security policies, detect and protect against cybersecurity threats, and help safeguard our material assets.

companyName: Talen Energy Corp

ticker: TLN


text: Our cybersecurity risk management and strategy are integrated into our enterprise-wide risk management program, which leverages a "three lines of defense" model to manage risk within the organization. Such model incorporates 1) day-to-day/operational activities and controls that are managed at the business unit level; 2) identification, measurement and mitigation of inherent security risks via the use of internal control and cybersecurity maturity frameworks, operating policies, independent monitoring, risk management and compliance oversight; and 3) internal audit designed to provide objective and independent validation of the design and operating effectiveness of cybersecurity and information security controls. Technology risk (including cybersecurity and overall operational risk) is identified as a key risk area for the Company, and utilizes a combination of manual and automated methods as well as internal and external resources to monitor, measure and mitigate cybersecurity risks.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. We have also developed a program and engaged with a bug bounty service for ongoing identification of exploitable vulnerabilities in the environment. Separately, our information security team also conducts regular scans of the environment to identify known vulnerabilities for remediation.

companyName: UPWORK, INC

ticker: UPWK


text: We believe that having a strong cybersecurity program, including robust risk management and oversight procedures, is critical to our business success. Our cybersecurity program includes written policies and standards that follow the guidance of well-recognized industry cybersecurity frameworks.

companyName: American Homes 4 Rent

ticker: AMH


text: The Evergy Board has assigned primary oversight of cybersecurity risk to the Operations Committee of the Evergy Board. At each Operations Committee meeting, the CTO discusses the Evergy Companies' cybersecurity metrics and scorecard performance; global, industry and Evergy-specific cybersecurity news; third-party assessments of the Evergy Companies' cybersecurity program; and industry benchmarking results. The Operations Committee meets regularly throughout the year and may meet more frequently or otherwise be informed of cybersecurity risk and incident information as needed. The CNO discusses with the Operations Committee risks specific to Wolf Creek, including cybersecurity risk. At least once each year, the Evergy Board receives a report from management on key business and compliance risks and related mitigation plans, and management discusses cybersecurity matters with the Evergy Board in connection with this report. The Evergy Companies also have a Security and Business Continuity Committee made up of internal security experts and several Evergy corporate officers. This committee meets bi-monthly to discuss relevant security and business continuity issues.

companyName: Evergy, Inc.

ticker: EVRG


text: As an investment manager, our business is highly dependent on information technology networks and systems. See "Risk Factors—Risks Related to our Organizational Structure and Business Operations". The occurrence of a cybersecurity incident or a failure to implement effective information and cybersecurity policies, procedures and capabilities has the potential to disrupt our operations, cause material harm to our financial condition, result in misappropriation of assets, compromise confidential information and/or damage our business relationships. Accordingly, we have invested significant time and resources into maintaining effective cybersecurity defenses and response plans. We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024, we have not experienced any material incidents from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: The Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: MPC engages with external resources to contribute to and provide independent evaluation of MPC's cybersecurity practices, including a periodical assessment of our cybersecurity program performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO") and the MPLX GP Audit Committee of the MPLX GP Board use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify, protect, detect, respond and recover from cybersecurity incidents.

companyName: MPLX LP

ticker: MPLX


text: We have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company and how they may do so, please see "Risk Factors - Risks Related to Information Technology Systems, Intellectual Property and Privacy Laws" included in Part I, Item 1A of this Annual Report on Form 10-K. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being unsecure, which could harm our business and reputation, and our proprietary business information could be misappropriated which could have an adverse effect on our business and results of operations."

companyName: Onfolio Holdings, Inc

ticker: ONFO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our CFO, who oversees our information security team and has over 3 years of experience overseeing such function.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: The CIO has extensive cyber security knowledge and skills gained from over ten years of relevant work experience at Noble including two years as Deputy CIO as well as Director, IT prior to the merger with Maersk Drilling with responsibility for cyber security. The CIO has multiple years of experience managing OT data and secure remote access for data management on and offshore. Prior to serving as Director, IT the CIO was the Manager, Business Systems responsible for application management and Enterprise Architecture. The Information Security Team advises the CIO on prevention, detection, mitigation, and remediation of cyber security incidents.

companyName: Noble Corp plc

ticker: NE


text: We rely on third-party service providers for a variety of services to run our information systems. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers.

companyName: VALUE LINE INC

ticker: VALU


text: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, penetration testing and cybersecurity threat intelligence. We identify and address information security risks by using a defense-in-depth methodology that provides multiple, redundant defensive measures in case if a security control fails or a vulnerability is exploited.

companyName: POTBELLY CORP

ticker: PBPB


text: The Company's Vice President of Information Technology is responsible for the Company's cybersecurity strategy and execution. He has more than 30 years of experience in technology and information systems leadership and reports directly to the Company's Chief Executive Officer.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: The IT Provider also has the ability to analyze cybersecurity presence and technology processes to provide reports as needed. The IT Provider currently manages and monitors our network, configures systems and controls, provides assistance and support during an incident and detects threats through antivirus scans, firewalls and base level spam filters.

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: Our cybersecurity team is led by the SVP of IT and Operations, who reports to our Chief Financial Officer. Our SVP of IT and Operations and the cybersecurity team have over 25 years of experience managing and securing technology infrastructure. The cybersecurity team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The cybersecurity team also institutes and maintains controls for our systems, applications, and databases. Our management, with involvement and input from our Board of Directors, performs annual enterprise-wide cybersecurity assessments to identify and manage key existing and emerging risks for our company.

companyName: Evolus, Inc.

ticker: EOLS


text: We are committed to complying with all applicable cybersecurity regulations, including those relevant to the operation of US LNG export terminals and natural gas pipelines. Our facilities and maritime operations are subject to the Maritime Transportation Security Act, and we are dedicated to meeting its applicable cybersecurity-related requirements as enforced by the US Coast Guard and relevant guidance from agencies such as the Cybersecurity and Infrastructure Security Agency. We are committed to continuously enhancing our cybersecurity defenses and incident response plans to adapt to the evolving threat landscape and protect our assets and stakeholders. Given the nature of our operations, a particular area of focus is the security of our Operational Technology and Industrial Control Systems, which are essential for the safe and continuous operation of our liquefaction plants, terminals, and related infrastructure. Protecting these systems from cybersecurity threats is paramount to prevent operational disruptions, ensure safety, and maintain the reliability of our energy delivery.

companyName: Venture Global, Inc.

ticker: VG


text: We face various cybersecurity risks, including those related to unauthorized access to and misuse of data, system interruptions, ransomware, malicious software and other threats. Our cybersecurity program incorporates information technology, retail technology and customer products designed to mitigate cyber risks. Our security measures are customized to meet our unique business requirements and encompass firewalls, intrusion detection and prevention systems, encryption and multi-factor authentication. We also engage external experts to enhance and assess our cybersecurity measures in the form of maturity assessments, incident response, penetration testing and other advisory services. We adhere to the practices and standards outlined by the National Institute of Standards and Technology Cyber Security Framework.

companyName: EZCORP INC

ticker: EZPW


text: Our information security program covers a wide range of cybersecurity activities, with the primary objective of maintaining the confidentiality, integrity, and availability of information for both our business and customers. The program and our systems are designed to identify and mitigate information security risks and data privacy breaches. Our risk mitigation processes include a cybersecurity incident response plan, which is regularly exercised through tabletop exercises, security awareness training with attack simulations to reinforce the training, cybersecurity risk assessments integrated with technology acquisition processes, and the utilization of third-party partnerships for threat intelligence, incident response and escalation, and attack surface monitoring.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Materiality is determined by considering qualitative and quantitative factors. The CSIRT team also conducts tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems in an ongoing and as needed basis. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Versus Systems Inc.

ticker: VS


text: Cybersecurity is an important priority at SES, and we actively manage this critical risk through comprehensive measures. Our processes for assessing, identifying, and managing material risks from cybersecurity threats are still in development and have yet to be integrated into our overall risk management system and processes.

companyName: SES AI Corp

ticker: SES


text: Impact of Cybersecurity Risks and Threats We are not aware of having experienced any risks from cybersecurity threats or incidents through the date of this Report that have materially affected the Company, its business strategy, results of operation or financial condition or are reasonably likely to have such an effect over the long term. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: The Company maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Company's overall risk management processes, which are overseen by the Board of Directors.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: The Board regularly reviews our cybersecurity and other technology risks, controls and procedures. The Board receives reports from our Chief Executive Officer and Chief Information Security Officer at least twice annually regarding our cybersecurity framework, as well as our plans to mitigate cybersecurity risks and to respond to any data breaches. Our cybersecurity infrastructure is overseen by our Chief Information Security Officer, who reports to our Chief Strategy, Transformation, Analytics and Technology Officer. Our Chief Information Security Officer has served in various roles in information technology and information security for over 20 years, including most recently leading the information security function of McCormick & Company. He holds a Ph. D. in information assurance & security, along with industry certifications that include ISACA Certified Data Privacy Solutions Engineer and Certified Information Security Manager and EC-Council's Certified Chief Information Security Officer certification.

companyName: Hanesbrands Inc.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Trinity Capital Inc.

ticker: TRIN


text: Electric utility System overview. The Utilities rely on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties, to support a variety of business processes and activities, including procurement and supply chain, invoicing and collection of payments, customer relationship management, human resource management, the acquisition, generation and delivery of electrical service to customers, and to process financial information and results of operations for internal and external reporting and compliance with regulatory, financial reporting, legal and tax requirements. The Utilities use their systems and infrastructure to create, collect, store, and process sensitive information, including personal information regarding customers, employees and their dependents, retirees, and other individuals.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our management team, including the CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: AIRGAIN INC

ticker: AIRG


text: Our Vice President of Information Technology and Facilities and our Head of Cybersecurity lead the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and work across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology and Facilities has over 34 years of experience delivering systems across all functions of life science organizations, including support of infrastructure, security, software as a service (SaaS) systems and data integrations, along with ten years working with cybersecurity. The Vice President of Information Technology and Facilities has also received Chief Information Security Officer (C-CISO) certification. The Head of Cybersecurity has approximately 15 years of cybersecurity expertise and has received Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP) certifications.

companyName: Immunovant, Inc.

ticker: IMVT


text: We view cybersecurity as a shared responsibility throughout the Company. At a management level, we periodically perform tabletop exercises incorporating external resources, advisors and relevant members of the Board as needed. The Company requires all employees to participate in an annual cybersecurity training reviewed by the information security function, and management regularly communicates with employees about potential cybersecurity risks and methods for reporting incidents. The Company has adopted and maintains an Incident Response Plan, which provides for various methods of reporting and escalation of incidents, activation of an incident response team consisting of relevant cross-functional leaders (e.g., legal, information security, operations), assessment of the severity of incidents, processes for investigating and remediating incidents and compliance with related legal and regulatory obligations, among other matters. The Incident Response Plan provides for the involvement of the Company's Disclosure Review Committee to assess the materiality of cybersecurity incidents and any disclosure obligations required in respect thereof. Management periodically reviews the Company's cybersecurity risk management strategy and processes - including the Incident Response Plan - to assess their efficacy in light of current and emerging threats.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: We believe our detailed incident response procedures enable us to effectively manage and mitigate the impacts of security breaches. Continuous monitoring and post-incident analysis further refine our security strategies, enhancing our protective measures. Our Board and the Audit Committee provide oversight over our cybersecurity efforts and stay regularly informed on cybersecurity matters, including emerging risks and mitigation strategies, to ensure informed governance over our enterprise risk assessments and cybersecurity approach. Cybersecurity matters are discussed regularly with senior management, and any significant cybersecurity events are promptly reported to the Board.

companyName: Cineverse Corp.

ticker: CNVS


text: Our board provides oversight of our risk management program, which includes cybersecurity risk management, via its Risk Oversight Committee. Among its responsibilities, the Risk Oversight Committee reviews and discusses, from a risk oversight point of view, reports on the Bank's current and emerging security risks, the metrics used to monitor security risks and management's views on the acceptable and appropriate levels of security risk. The Risk Oversight Committee also reviews and makes recommendations to the board regarding the approval of the EISP.

companyName: Federal Home Loan Bank of Indianapolis


text: Significant cybersecurity incidents are elevated within the hierarchy of management and assessed by a cross-functional, executive management-level team, which is responsible for making the necessary strategic decisions, prioritizing actions that can minimize the impact of the cybersecurity incidents on us and our customers, and determining the materiality of such incidents.

companyName: DNA X, Inc.

ticker: SONM


text: The Trust is a grantor trust, conducts no active operations, has no customers, and maintains no personal or credit data. The Trust's from cybersecurity threats are tailored to its specific circumstances.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: The Company's cybersecurity risk management strategy is comprised of several key elements. We assess our information technology and data management/storage systems and related policies and practices and to help guide and prioritize our cybersecurity and information technology-related investments, activities and risk management strategy. We leverage a variety of technologies to attempt to mitigate the risk of cybersecurity threats and incidents. The Company has a multi-layer approach to its technology solutions, including employing applications used for perimeter, network, end point and application security as well as for data recovery, in each case tailored to the Company's systems, data, risk profile and mitigation strategy. From time to time we use third-party service providers and software to augment and test our technology solutions and further support our risk mitigation strategy.

companyName: CTS CORP

ticker: CTS


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer ("CFO") of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: CEO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CEO, with the help of external consultants, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system checks to identify potential vulnerabilities.

companyName: Clubhouse Media Group, Inc.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business strategy. See "Risks Related to Our Information Technology, Cybersecurity and Data Protection" in Part 1, Item 1A. Risk Factors of this report for a discussion of these risks. With respect to our cybersecurity process, we are not aware of any material breach to date.

companyName: BGSF, INC.

ticker: BGSF


text: Periodically, the Company, as it reasonably deems necessary, will identify and categorize potential cybersecurity threats and vulnerabilities, determine acceptable risk tolerance for each such threat and vulnerability and implement adequate mitigation controls. At the senior executive level, the CFO is entrusted with the day-to-day oversight of the program's development, implementation, and maintenance. To help facilitate Company-wide compliance with the plan, the Company, as well as its subservicers, provide ongoing training to the appropriate employees.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Board of Directors has the responsibility to require USPB to have adequate oversight of risks from cybersecurity threats. Management's role in assessing and managing our risks from cybersecurity risks has similarly been limited to the engagement of NBP to provide information technology equipment and services. If NBP were to inform us of a cybersecurity incident, that incident would be reported to the Board if material in nature.

companyName: U. S. Premium Beef, LLC


text: The state of our cybersecurity program Significant security incidents and their resolution Results of security assessments and audits Progress on security initiatives and investments Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Senior Vice-President of IT, who has over 20 years of experience in information technology and cybersecurity, including a Bachelor of Science degree. Our SVP of IT reports directly to our Chief Executive Officer on a monthly basis and is responsible for updates to the Audit Committee regarding our cybersecurity posture and initiatives.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Information about our material cybersecurity risks can be found in Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: Our audit committee of the board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of risks from cybersecurity threats.

companyName: Definitive Healthcare Corp.

ticker: DH


text: Our awareness and training program creates a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have empowered and conditioned our global workforce to recognize and resist phishing attempts with our simulated phishing program. At least quarterly, our employees are presented with simulated phishing scenarios that deliver hands-on experience and on-the-spot education opportunities. All engineers and employees holding equivalent roles who are involved in software development also receive mandated secure software development training.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: The Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), and Chief Financial Officer ("CFO") are actively involved in managing cybersecurity risks. They receive regular updates, which include an overview of the current cybersecurity landscape, the status of ongoing initiatives, and compliance with regulatory requirements. We are establishing structured processes for ongoing communication among the executive team to ensure they remain informed and involved in key cybersecurity decisions.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Corporate Governance and Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of directors who have diverse qualifications and experiences.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Senior Director of Information Technology and Chief Financial Officer.

companyName: BioAge Labs, Inc.

ticker: BIOA


text: As of the date of the filing of this Form 10-K, we are not aware of any successful attempts by third parties to gain access to our systems and networks and do not believe that any such attempts have had a material effect, or are reasonably likely to have a material effect, on our business, operations, or financial condition.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: In 2024, we did not experience any material cybersecurity incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—The unauthorized access to our information technology systems or the disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Failure of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of their criticality to its business and risk profile.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: We maintain an incident response plan (IRP) aligned with NIST RMF when responding to incidents. The IRP sets out a coordinated approach to investigating, containing documenting and mitigating incidents. Our CISO, with oversight from our Chief Information Officer (CIO), is responsible for executing the relevant cybersecurity incident response plan, which includes response criteria for materiality, applicable requirements for incident disclosure and reporting and escalation procedures to various individuals and departments, including our Audit Committee, key stakeholders, and senior management, including our General Counsel, Chief Financial Officer and Chief Executive Officer, for risks with a potentially material impact for responding to cybersecurity incidents. In addition to our in-house team and third-party security operations services, we also engage assessors, consultants, auditors and other third parties from time to time to assist with assessing, identifying, and managing cybersecurity risks. For example, we leverage third-party security and compliance companies with subject matter expertise in these areas for threat identification and remediation. We continue to work with the U.S. Department of Defense on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks, including through participation in the Department of Defense's collaborative information sharing. We also partner with other work groups to support understanding and deployment of the Cybersecurity Maturity Model Certification (CMMC) to promote readiness in complying with cybersecurity requirements for handling CUI and federal contract requirements.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: Technical Safeguards: The Company deploys technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, all of which are evaluated and improved through vulnerability assessments on a periodic basis.

companyName: WillScot Holdings Corp

ticker: WSC


text: Our CTO and CISO lead our Cybersecurity Incident Response Plan management of cybersecurity incidents with a cross-functional team to assess the potential materiality of cybersecurity events and to report on the detection, analysis, containment and eradication of and recovery from such events. As the severity of events meet certain criteria, as specified by the Incident Response Plan, those events are escalated to senior levels of management and reported to our Disclosure Committee and the Audit Committee. Our Disclosure Committee is responsible for the oversight of controls and procedures related to the public disclosure of material cybersecurity incidents.

companyName: STEELCASE INC


text: Our board of directors has ultimate responsibility for oversight of our risk management, and delegates cybersecurity risk management oversight to the audit committee. The audit committee, which is responsible for ensuring that management has processes in place designed to identify, evaluate and manage cybersecurity risks and incidents, regularly reviews our cybersecurity program with management and reports to the board of directors. Cybersecurity reviews by the audit committee generally occur at least quarterly. A number of our directors have experience in assessing and managing cybersecurity risk, including by serving on other public company audit committees having responsibility for cybersecurity oversight.

companyName: Perception Capital Corp. IV


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident. Further, we conduct periodic tabletop exercises to test our cyber incident response plan.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our cybersecurity leadership team consists of our Director and Chief Information Security Officer, Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. As part of their governance and risk management responsibilities, these individuals oversee the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, including the systems deployed in our technology infrastructure to monitor for threats, perform security control testing and assessments, and incorporate threat intelligence into our day-to-day cybersecurity operations and strategic initiatives. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Like any other technology company operating in today's environment, we have experienced incidents in the past and may experience them in the future. However, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding risks from cybersecurity threats, and their effect on our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors – Risks Related to Our Business, Operations, and Industry – Breaches of our security systems or products, systems failures, interruptions, delays in service, catastrophic events, and resulting interruptions in the availability of our systems or those of our customers, suppliers, or business partners, could expose us to losses."

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Our information security program is integrated into our overall enterprise risk management program. Our information security program includes, among other things: • cybersecurity incident response; • vulnerability management; • antivirus and malware protection; • technology compliance and risk management; • encryption; • identity and access management; • application security; and • security monitoring.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: We are reviewing our security training protocols to ensure all employees received annual security training for all employees. This security training will be focused on overall InfoSec, privacy best practices, and review of company policies.

companyName: Rumble Inc.

ticker: RUM


text: Our Chief Information Officer and Chief Operating Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: Our management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis by establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors, including through the audit committee of our board directors.

companyName: Braze, Inc.

ticker: BRZE


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See our risk factor disclosures in Part I, Item 1A of this Annual Report.

companyName: SYNOPSYS INC

ticker: SNPS


text: The Company's cybersecurity risk management and strategy processes are overseen by leaders from the Information Technology team (specifically, the Company's chief technology officer, its chief information officer, and its senior manager for cybersecurity) who collectively have over 75 years of prior work experience in various information technology roles, including security, auditing, compliance, systems and programming, and whose credentials have included Certified in the Governance of Enterprise IT (CGEIT), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Security Professional certifications. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of the Company's incident response plan. Potentially significant cybersecurity incidents are reported to the Breach Response Team. If the Breach Response Team deems the incident material, it will promptly notify the Audit Committee or the full Board of Directors. The Audit Committee or Board receives updates regarding other incidents during management's regular quarterly cybersecurity updates. In addition, the Company's Internal Audit function, whose leader possesses a Certified Information System Auditor (CISA) certification, reviews certain cybersecurity controls in connection with its information technology audit procedures.

companyName: MOVADO GROUP INC

ticker: MOV


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems may fail or experience security breaches and incidents that could adversely impact our business and operations and subject us to liability."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: The Board and Audit Committee receive regular but no less than quarterly reports from management, and on an ad hoc basis, on information and operational technology risks, including cybersecurity and data security risks, as well as on the status of projects to strengthen our information security systems, assessments of our security program, and the emerging threat landscape.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: The security and infrastructure teams are responsible for the continuous monitoring, reporting and response to threats and vulnerabilities discovered through the deployment and operation of these tools. As part of our risk management strategy, our cybersecurity team conducts routine vulnerability and risk assessments within our product operations and service environments. The results of these reviews and any incidents identified by security tooling are reported to senior management and the internal steering committee as part of the quarterly reporting process. As part of routine security assessments, if any deficiencies relating to internal technology controls over financial reporting are discovered, the VP of Security is required to report them directly to the executive management team and internal steering committee without delay.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: At the level of the general employee population, we hold trainings on privacy and information security, records and information management, and information security regulatory compliance, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through broad communication and educational initiatives, depending on the employee's level, role and exposure to sensitive systems and the associated cybersecurity risk profile. We also contract with an external vendor to monitor alerts in real time on cybersecurity incidents.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Donaldson recognizes the critical importance of cybersecurity. Protecting the confidentiality, integrity and availability of our data, we focus on building resilience into the very fabric of our enterprise digital ecosystem. Our cybersecurity program is comprehensively integrated within our enterprise risk management and encompasses the enterprise information technology (IT) and operational technology (OT) environments. Our cyber risk management program controls are based on industry-recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO) 27001 information security management system requirements.

companyName: DONALDSON Co INC

ticker: DCI


text: Management Oversight of Cybersecurity Risk Management CIM's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM's Chief Technology Officer (the "CTO"), CIM's Chief Compliance Officer (the "CCO") as well as representatives from CIM's operations, compliance and accounting departments. The Committee is responsible for CIM's cybersecurity policy and overseeing the activities of CIM's cybersecurity practices, including assessing CIM's risks and controls. The Committee is chaired by the CTO and has more than 30 years' experience in the field of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee have relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and has multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.

companyName: CIM Opportunity Zone Fund, L.P.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company or its financial position, results of operations and/or cash flows.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: Our cybersecurity program is integrated into our broader enterprise risk management framework. For example, certain members of our executive management evaluate material risks from cybersecurity threats against our overall business objectives and report to our Risk Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: Everpure, Inc.

ticker: PSTG


text: 8x8 recognizes the critical importance of cybersecurity in maintaining the integrity, confidentiality, and availability of its systems and data. As a leading provider of communication and collaboration solutions, 8x8 is committed to safeguarding its assets, including customer data, from evolving cybersecurity threats.

companyName: 8X8 INC /DE/

ticker: EGHT


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Operating Officer. The COO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The COO has previously led IT programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: Risks from Cybersecurity Threats While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, we also maintain cybersecurity insurance to manage potential liabilities resulting from specific cyber-attacks. However, it's important to note that although we maintain cybersecurity insurance, there can be no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. As of December 31, 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The Board of Directors reviews components of the information security program on annual basis including policies, procedures, risk assessments, table top testing results, attestations, budgets and strategies. These components are presented by Executive Management as part of the regular board meeting schedule and strategic planning process.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committee on our cybersecurity risk management program.

companyName: Seer, Inc.

ticker: SEER


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO) and notify the CEO. The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: During fiscal 2025, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect us or our strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: We conduct regular internal workforce training and awareness programs, perform internal testing and assessments of controls where appropriate, and periodically engage external service providers and consultants to conduct assessments, evaluations, and penetration testing activities.

companyName: Canoo Inc.

ticker: GOEVQ


text: Our assessment and management of material risks from cybersecurity threats are integrated into our broader enterprise risk management strategies. Cybersecurity risks are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are periodically reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these third parties have provided us with services that include external penetration testing, cybersecurity audits, legal counsel, threat intelligence information, forensic investigations, and managed security service.

companyName: ONITY GROUP INC.

ticker: ONIT


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The board has established robust oversight mechanisms and is willing to cause the Partnership to expend significant resources to further enhance digital security or to remediate vulnerabilities to ensure effective governance in managing risks associated with cybersecurity threats. The Board recognizes the significance of these cybersecurity threats to our operational integrity and stakeholder confidence.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our IT team, including our Vice President of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: The Company continues to build its culture of security and has integrated cybersecurity risk management into our broader enterprise risk management process. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes and operational practices. Our information technology department works closely with our senior management team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: GORMAN RUPP CO

ticker: GRC


text: The Board of Directors' Oversight of Cybersecurity Risks Our Board of Directors (the "Board") maintains principal oversight responsibility for our ERM program. This oversight is facilitated primarily through the Audit Committee of the Board of Directors, which is responsible for oversight of our cybersecurity risk management processes. The chairman of our Audit Committee has earned a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors, which aids the Audit Committee's understanding of cybersecurity risks and assists the Audit Committee in overseeing the risk management program.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Independent Audit and Testing. The Company's Audit Department schedules and oversees a regular review of program design and effectiveness by independent third -party audit firms that specialize in technology and cybersecurity. Results are reported directly to senior management and the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: We periodically engage third-party consultants and service providers to obtain an independent assessment regarding internal efforts to prevent threats on our Information Systems. Continuous vigilance over safeguarding the Company's Information Systems have resulted in our current approach and these assessments are shared with our Audit Committee.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our organizational strategy, results of operations, or financial condition as part of our risk factor disclosures in Part I, Item 1A of this report.

companyName: Science Applications International Corp

ticker: SAIC


text: The Company maintains a comprehensive cybersecurity management and governance program. The Company's information security management system is based upon the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The Company engages internal and third-party auditors and other professional parties when necessary, as part of its cybersecurity management program. The Company conducts penetration and compromise assessment tests, implements detection and prevention tools, monitors cyber events and has active disaster recovery plans. For third-party IT services, the Company conducts an architectural, privacy and security analysis of their solution. If any gaps are identified, the third-party remediates or mitigates the risk to an acceptable level. The Company simulates potential cyber-attacks and performs incident responses to test preparedness. These exercises are used to train and update the Company's Incident Response plan, including any gaps identified. The Company conducts yearly information security training for employees and conducts ongoing phishing tests.

companyName: PACCAR INC

ticker: PCAR


text: Cybersecurity Committee The mission of the Cyber Security Committee is to be responsible for the cultivation of a corporate culture that recognizes risk awareness and the development of the Company's cyber security solutions, utilizing thought leadership, technology and systems, and development of applicable policies and procedures. Through its cyber security policy and procedures, the Committee will ensure effective collaboration and coordination between affected departments and staff in identifying and responding to both privacy and cyber security risks and events. The Committee will oversee the development and implementation of an enterprise-wide strategic framework related to the identification and prevention of cyber security threats as an integral part of the Firm's risk management process, otherwise known as CISP. The Firm's cyber security framework is intended to be "evolutionary", requiring (i) periodic reviews, and (ii) testing of systems, that result in changes to Company policy and procedures, as cyber security issues and developments require. The Committee shall be composed of specified members of senior management, department heads and staff, who have been selected based upon their backgrounds and experience involving IT, Risk Management, Operations, Compliance, and Legal. The Committee shall have the discretion to engage and utilize the services of independent vendors, computer service providers (eSP's) and consultants having expertise in the area of cyber security and IT. The Committee shall determine its meeting agendas and frequency of meetings which shall be reported through minutes prepared by the designated secretary.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: Our cybersecurity program includes a number of components, such as: • regular cybersecurity risk assessments, audits, and penetration tests; • policies generally aligned with industry standards such as Information Security Standard ("ISO") / International Electrotechnical Commission –27001 and the PCI Data Security Standard; • measures to block and prevent certain malicious activity, such as endpoint detection and response controls; • measures to block and prevent certain network attacks, such as firewalls and Distributed Denial of Service mitigation tools; • measures to secure remote access, such as virtual private networks and multi-factor authentication; • cybersecurity training programs for employees, contractors and agents, including regular phishing simulations; • a vulnerability disclosure program to compensate researchers for responsible disclosure of vulnerabilities in our platform; • the maintenance of a Security Incident Response Plan with periodic tabletop testing; and • third-party risk management processes designed to manage risks associated with vendors and suppliers.

companyName: LIVEPERSON INC

ticker: LPSN


text: Our executive leadership team meets with our Head of Global Information Technology, along with other members of our IT security team as needed, to discuss cybersecurity matters, such as the emerging cybersecurity threat landscape, significant developments to our cybersecurity processes, and our cybersecurity risk assessments. Senior management is thus kept abreast of the cybersecurity posture and potential risks facing our company. Our cybersecurity incident response process is designed to proactively triage, contain, investigate, mitigate and correct all incidents at the direction of the Head of Global Information Technology. Critical incidents are assessed for materiality, and escalated to the executive leadership team for awareness, direction and approval as needed. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, as needed, to provide oversight and guidance on critical cybersecurity issues.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: The Assignor Limited Partner, under the supervision and with the participation of the Principal Executive Officer and Principal Accounting and Financial Officer, is responsible for directing and overseeing our risk management. The Principal Executive Officer and Principal Accounting and Financial Officer administers this oversight function directly. In particular, the Principal Executive Officer and Principal Accounting and Financial Officer has the responsibility to consider and discuss our major financial risk exposures and the steps BFIM takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. The Principal Executive Officer and Principal Accounting and Financial Officer also monitors compliance with legal and regulatory requirements.

companyName: BCTC IV ASSIGNOR CORP


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: We promote a company-wide culture of cybersecurity risk management intended to protect the confidentiality, integrity, and availability of our critical systems and the information contained therein. As part of our cybersecurity risk management strategy, our corporate information technology team collaborates cross-functionally with key business leaders within privacy, compliance, finance and operations, among others, to identify, assess, and manage cybersecurity risks relevant to our business. On a quarterly basis, led by the Chief Information Security Officer (CISO) and Privacy Officer, the cybersecurity and privacy governance committee meets, which comprises of our executive and regional leadership teams. This governance committee assists in discussing existing or emerging threats, prioritizing roadmap items and/or budgetary considerations for project work.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Our cybersecurity program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: ARDELYX, INC.

ticker: ARDX


text: Our board of directors is responsible for oversight of risks from cybersecurity threats in conjunction with our executive management team. Our board of directors receives updates from our management team with respect to risks from cybersecurity threats and are notified of any new significant cybersecurity threats or incidents as they arise. Additionally, our board of directors considers risks from cybersecurity threats as part of its overall assessment of risk management, including its general oversight of the Company's business strategy, risk management policies, and financials.

companyName: Dror Ortho-Design, Inc.

ticker: DROR


text: We conduct annual risk assessments and penetration tests to identify cybersecurity threats, including assessments and tests with the assistance of independent third-party cybersecurity consultants. We also conduct assessments in the event of a material change in our business practices that may affect key information systems that are vulnerable to such cybersecurity threats. These assessments and tests are designed to assist in the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following risk assessments and penetration tests, we work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: The Board of Directors and the Nominating and Corporate Governance Committee receive presentations and reports on cybersecurity, which address a range of topics including recent developments, evolving standards, the threat environment, cybersecurity systems testing and vulnerability assessments, and the Company's practices and policies to manage risks. Management reports to the Nominating and Corporate Governance Committee on cybersecurity matters and materials risks, if any, from cybersecurity threats. Our Nominating and Corporate Governance Committee provides updates to the Board of Directors on such reports. The Nominating and Corporate Governance Committee also receives notice of any significant cybersecurity incidents, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: AMBARELLA INC

ticker: AMBA


text: We have not experienced any material impacts from any cybersecurity threats or incidents in the last three fiscal years. We use each cybersecurity threat or incident as an opportunity to review our protocols and implement enhancements as applicable. For more information about our risks from cybersecurity threats, see Item 1A—Risk Factors—A failure of one or more of our key information technology ("IT") systems, networks, processes, associated sites, or service providers could have a negative impact on our business.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Our information and cybersecurity governance program is the foundation of our cybersecurity risk management strategy. The program includes policies which authorize and guide the development of procedures, standards, and guidelines for personnel activities, incident prevention and reporting, and compliance monitoring. Cybersecurity policies, procedures and controls are reviewed and approved by our Information and Cybersecurity Program (ICSP) group annually, with amendments made as deemed necessary for any updates for regulatory compliance and best practices, legal privacy protection and information protection, or to reflect current technology or new methods for ensuring secure business procedures.

companyName: Otter Tail Corp

ticker: OTTR


text: The Company utilizes an independent external firm that provides services to detect cybersecurity risks and makes recommendations to the Company regarding ways the Company can better protect itself from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Additionally, as part of its processes for assessing, identifying and managing risks from cybersecurity threats, the Company intends to periodically conduct maturity and other external cybersecurity assessments to evaluate its cybersecurity maturity and enhance its cybersecurity capabilities. The Company's auditors also perform annual inquiries and risk assessments into cybersecurity practices and potential incidents.

companyName: Orion Properties Inc.

ticker: ONL


text: Our Chief Financial Officer, who reports directly to the Chief Executive Officer and has over 15 years of experience managing information technology and cybersecurity matters, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Shuttle Pharmaceuticals Holdings, Inc.

ticker: SHPH


text: To emphasize the importance of cybersecurity awareness, advise of cybersecurity threats, and provide examples of how to mitigate such threats in their use of PFG systems, we also maintain an information security training program that combines several forms of training, including routine phishing exercises, across our workforce.

companyName: Performance Food Group Co

ticker: PFGC


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident.

companyName: COLOMBIER ACQUISITION CORP. II


text: RISK MANAGEMENT AND STRATEGY 1st Franklin is committed to maintaining the confidentiality, integrity and availability of our data and information systems. We understand the risks presented by existing and emerging cybersecurity threats against our electronic infrastructure and the information it stores and processes, as well as against our customers and employees. We also recognize that there are cybersecurity risks associated with remote work environments which are utilized by some of 1st Franklin's employees, our use of cloud-based infrastructure and networks, and our use of third parties to support our operations.

companyName: 1st FRANKLIN FINANCIAL CORP


text: As mentioned above, the CISO is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CISO has work experience in various roles in risk management, including developing information and cybersecurity strategy/programs, information security audit and assessments, cybersecurity operations focused on identification, mitigation and response to cybersecurity threats. The CISO has experience leading enterprise global efforts to align systems to industry-accepted standards and practices, as well as regulatory compliance requirements. The CISO has degrees in the areas of management of information systems and cybersecurity, and also maintains several information security and technology certifications, including as a Certified Information System Security Professional ("CISSP") and Boardroom Certified Qualified Technology Expert ("QTE").

companyName: KELLANOVA


text: We have also established a cross-functional Cybersecurity Committee led by our Chief Business Officer serving as the chair and consisting of senior leaders within our organization. The Cybersecurity Committee, with assistance from our outside information technology management/cybersecurity consultant, oversees our cybersecurity policy, which includes risk assessment, investments in cybersecurity technologies, cybersecurity insurance and review of relevant information technology policies.

companyName: KALA BIO, Inc.

ticker: KALA


text: Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with currently recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engage s personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: We recognize the importance of assessing, identifying and managing material risks from cybersecurity threats. Our cybersecurity program focuses on (i) identification of and protection from cybersecurity risks, (ii) detection and analysis of cybersecurity events, (iii) response to and recovery from cybersecurity incidents, and (iv) education and awareness. Under our program, designated personnel are responsible for: • assessing the severity of a cybersecurity incident and associated threat; • containing the threat; • remediating the threat, including recovery of data and access to systems; • analyzing the reporting obligations associated with the incident; and • performing post-incident analysis and program improvements.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: The cybersecurity program and related risks at CSX are managed by the VP Technology and CISO. The Company's CISO is a Certified Information Systems Auditor with over 30 years of industry experience including information security leadership positions at multiple publicly-traded companies.

companyName: CSX CORP

ticker: CSX


text: Presidio Property Trust uses a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and an annual third-party review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters on at least an annual basis.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: We have implemented a cross-departmental approach to managing cybersecurity risk, which includes seeking input from our employees, management, third-party vendors, the Audit Committee of the Board of Directors (the "Audit Committee"), and the Board of Directors. We devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. To more effectively address cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and response.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: The information required by this Item is provided under "Information Technology Risk Management" included in Item 7, Management's Discussion and Analysis in this Form 10-K, and is incorporated herein by reference.

companyName: STATE STREET CORP

ticker: STT


text: The CIO has extensive leadership experience with 25 years of experience in information technology, project management, business applications including manufacturing. The CISO is responsible for overseeing our cybersecurity risk management program, in coordination with the CIO and our other business leaders, including in the legal, internal audit, finance and risk management departments. The CISO has extensive cybersecurity knowledge and skills gained from over 25 years of technical and business experience in the cybersecurity and information security fields. The CISO reports directly to the CIO who in turn reports directly to the Chief Financial Officer. The CISO receives reports on cybersecurity threats on an ongoing basis and, regularly reviews risks to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with our legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: Risk Management and Strategy have not yet developed a cybersecurity risk management program, though we are in the process of assessing the potential risks. As of this time, we have determined that risks from cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: Company recognizes the critical importance of cybersecurity in protecting our sensitive data, intellectual property, and the personal information of our employees and partners. We have implemented a comprehensive cybersecurity risk management program that includes the following key components:

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: Everest provides resources and learning opportunities to educate all of our colleagues on how to identify, report, and be vigilant against cybersecurity threats in the workplace. In addition, we conduct cybersecurity incident simulation exercises with business, information technology, management, and other key stakeholders to practice and test response processes. Furthermore, the Company collaborates with industry associations, government and regulatory authorities, peer companies and external advisors to monitor the threat environment and to inform its cybersecurity practices.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: We have implemented internal controls designed to both prevent and detect cyber attacks and continue to review and enhance our internal controls and procedures in response to the heightened risk and occurrence of cyber threats. Our cybersecurity controls, which are the mechanisms in place to prevent, detect and mitigate risks in accordance with our policies and procedures, are designed to satisfy the regulatory requirements to which we are subject and are monitored and tested both internally and externally. We are currently ISO 27001 certified and obtain an annual SOC2, Type 2 report from a qualified external auditor attesting to the effectiveness of our key cybersecurity controls. Additionally, we maintain redundant data center capabilities for business continuity and disaster recovery in the event of a cybersecurity incident that impacts the availability of our primary operational platforms. Continuously enhancing our IT environment to meet the increasing needs of cybersecurity and privacy regulations remains a top priority.

companyName: HireRight Holdings Corp


text: Both the Risk and Audit Committees of our Board have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: As of September 30, 2024, we did not establish policies and processes for assessing, identifying, and managing material risk from cybersecurity have integrated the processes of assessing, identifying, and managing material risk from cybersecurity threats into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Zhuoxun Hongtu Inc.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: BurgerFi International, Inc.


text: The Company has appointed the Senior Director of Information Security ("DISO") to oversee the implementation, coordination, and maintenance of the ISP. The responsibilities of the DISO include developing and implementing our information security program, designing appropriate administrative, technical, and physical safeguards to protect institutional data and ensuring the implementation and maintenance of safeguards across the Company as needed. The DISO reports to our Chief Risk Officer and has over a decade of experience leading cybersecurity oversight along with expertise in cyber-crime prevention, threat intelligence, social engineering, identity access and governance, identity theft and fraud prevention through prior roles in the organization. The Information Security team has cybersecurity experience or certifications, such as the Certified Information Systems Security Professional and Certified Information Security Manager from the Information Systems Audit and Control Association.

companyName: NBT BANCORP INC

ticker: NBTB