text: Customers' Directors' Risk Committee receives a monthly Cybersecurity Risk Indicators report from the CISO which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report named "The State of Security" is compiled and shared with Customers' Directors' Risk Committee summarizing the previous year's activities along with a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified on an annual basis by the Board of Directors who provide oversight of executive-level enforcement and compliance. Customers also utilizes several global external advisors to ensure the appropriateness of its security posture, adherence to established controls, proper assessment of risk, and efficient operation of its cybersecurity discipline. Customers' Board of Directors includes a vetted board member who possesses expertise in Information Security across various domains.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Moreover, we have implemented appropriate policies, processes, and technology to reduce the likelihood or impact of a breach, either at US Foods or through any third-party service provider, and have appropriate cyber insurance coverage through a standalone cyber policy. Our comprehensive cybersecurity program leverages technology, third-party expertise and trained personnel to provide whole-enterprise governance, collaboration for 24-hour monitoring, threat detection and incident response (whether an incident were to occur at US Foods or involving a third-party provider) and network, cloud and mobile security. We partner with security firms to manage our security incident and event management, identify external threats, perform penetration testing, complete security assessments and support incident response. These relationships are evaluated and benchmarked regularly to ensure quality resourcing to augment our internal staff and provide insight into emerging risks inside and outside the foodservice industry. Information obtained from these processes is shared directly with our Internal Audit and Legal functions to ensure cybersecurity policies, processes, threat detection and incident response are accurately captured as part of our broader enterprise risk management systems and processes. We have developed and continually evolve our privacy and security policies to promote organizational accountability for privacy, data governance, and data protection across our business and with our collaborative partners and suppliers.

companyName: US Foods Holding Corp.

ticker: USFD

secItem: Item 1C


text: As part of our overall cybersecurity risk management process, our management engages at least annually in the review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security controls. Any failure in our key service providers' cybersecurity systems could have a material impact on our operating results. See "Risk Factors - Risks Related to our Business and Structure - A failure of cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Our ITVP has over twelve years of experience in IT at Portillo's, including managing cybersecurity risks. He reports to our Chief Financial Officer and updates her on a weekly basis. Our Chief Financial Officer discusses IT matters, including security, during weekly executive leadership meetings and may call upon the ITVP periodically to report directly to the team. Following these meetings, the ITVP works with his team to address any feedback received. Cybersecurity and privacy objectives are built into the ITVP's annual objectives and those of his team and his short-term incentive compensation reflects how successful he, the team and the Company are at accomplishing those objectives.

companyName: Portillo's Inc.

ticker: PTLO


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have adopted security-control principles based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and other industry-recognized standards, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use these principles as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity strategy prioritizes detection, analysis, and response to known, anticipated or unexpected threats. We implement and continue to update risk-based controls to protect key information and systems. Some of the controls and processes in place to manage risks from cybersecurity threats include monitoring systems, enforcement mechanisms, employee training, tools and related services from third-party providers, and management oversight.

companyName: Karat Packaging Inc.

ticker: KRT


text: Oversight and Identification of Risks Associated with Third Parties Information Security, in coordination with Third Party Risk Management, reviews new vendors at onboarding to oversee and identify potential risks and performs ongoing monitoring of emerging risks related to any third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and review of SOC reports. New technology projects are subject to a Security Architecture Review completed by Information Security. Information Security coordinates with Contract Management to perform contract reviews for security controls and notification processes. Information Security conducts annual IT Risk Assessments on Tier 1 applications, defined as those vendors of critical importance to the Company's core operations.

companyName: Independent Bank Group, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our VP of Information Security and the Security Team. For strategic decisions regarding cybersecurity, the VP of Information Security consults with the Chief Product Officer, the Chief Financial Officer, the General Counsel and Chief Compliance Officer, and the VP of Compliance.

companyName: OptimizeRx Corp

ticker: OPRX


text: As part of its risk oversight responsibility and pursuant to its charter, the Audit Committee, in consultation with the Board and the Board's other committees, oversees EOG's policies, strategies, and initiatives for mitigating cybersecurity and information technology risks.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our current DVP, Information Security has led the information security program at TaskUs for nine years, and has over a decade of prior experience in cybersecurity operations, risk assurance and internal audit. Additionally, he holds an MBA degree and multiple professional certifications including CISSP (certified information systems security professional), CISA (certified information systems auditor), CIA (certified internal auditor), CCSP (certified cloud security professional) and CRMA (certification in risk management assurance). The DVP, Information Security also leads our Information Security Council, which is composed of IT functional leads and is responsible for the quarterly review of cybersecurity risks and operations of the information security management system.

companyName: TaskUs, Inc.

ticker: TASK


text: The Board Operational Risk Committee oversees the management of risks from cybersecurity threats, including policies, processes and practices implemented by Company management to address such risks. The Board Operational Risk Committee receives presentations and reports on cybersecurity risks and information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates until such incident has been addressed. At least once each year, the Board Operational Risk Committee discusses the Company's approach to cybersecurity risk management with our CISO. Further, the Board periodically, as warranted, receives reports with respect to and engages in discussions with Company management on cybersecurity matters.

companyName: LendingClub Corp

ticker: LC


text: In an effort to reduce the likelihood and severity of cyber intrusions, the Companies have a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of data and systems. Consideration of cybersecurity risks is a key component of the Companies' overall risk management and integrated into processes such as evaluation of potential new vendors or suppliers. The Companies are subject to mandatory cybersecurity regulatory requirements, interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities.

companyName: VIRGINIA ELECTRIC & POWER CO


text: Our Chief Information Security Officer ("CISO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee on a quarterly basis or as needed. These briefings encompass a broad range of topics, including emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: AUTONATION, INC.

ticker: AN


text: We have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: OKMIN RESOURCES, INC.

ticker: OKMN


text: We have implemented a process to periodically conduct security awareness training for employees and simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.

companyName: 908 Devices Inc.

ticker: MASS


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.

companyName: Turnstone Biologics Corp.


text: To facilitate the prevention, detection and timely response to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for managing our information security strategy, policies, standards, and processes. The CISO reports directly to our Chief Digital & Technology Officer ("CDTO"), who reports directly to our Chairman, President and Chief Executive Officer. Our CDTO and CISO have extensive experience and expertise in developing, implementing, and operating security policies and procedures covering our network and critical data. The CDTO and CISO regularly review cybersecurity matters with members of our senior management. These discussions include the latest cybersecurity risks and threats, the status of our cybersecurity incident response plan, and our overall process relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: AAR CORP

ticker: AIR


text: We have established an Enterprise Risk Management program. As part of this program, the C&RM team reviews our IT risk management practices, which are designed to identify, assess, manage, monitor, and report cybersecurity risks. The IT team is responsible for implementing risk management practices set forth in the IT risk management program.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: To date, we have not encountered cybersecurity challenges that have materially impaired our operations or financial condition. Additional information regarding risks from cybersecurity threats is provided at "Item 1A. Risk Factors".

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Our management team, including our CITO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity risk management is led by our CITO, who has extensive experience in cybersecurity, information risk management, digital innovation, technology transformation, operations, and regulatory compliance. The CITO is supported by dedicated security professionals and external advisors to ensure a comprehensive and adaptive security strategy.

companyName: Shake Shack Inc.

ticker: SHAK


text: The board of directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The audit committee of the board of directors (the "Audit Committee") has been designated by our board of directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management. The board of directors also receives periodic updates from management and the Audit Committee on cybersecurity risks. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Executive Officer. Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects.

companyName: iPower Inc.

ticker: IPW


text: Incidents, regardless of severity, are evaluated and documented and are shared with the audit committee. In 2024, the audit committee received four updates on matters related to cybersecurity. The process of evaluating and documenting individual incidents, even when not deemed material, assists in determining how previous incidents have or may reasonably likely have a material effect on the company in the future.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: DIH HOLDING US, INC.


text: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations, the scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: Recognizing that traditional antivirus may not always be applicable, we deploy specialized security software to detect and prevent malware threats.

companyName: Health In Tech, Inc.

ticker: HIT


text: The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise Asset Management, Inc. ("BAM"), the parent of the Sponsor, receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund is assessed on an ongoing basis, as well as how such risks could materially affect the Fund's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Fund, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Fund's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Fund has not experienced any material cybersecurity incident, and the Fund is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.

companyName: Nuveen Churchill Private Capital Income Fund


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company by the Board of Directors (the "Board"). This committee is chaired by our Chief Technology Officer & Chief Operating Officer and includes a diverse cross section of company stakeholders including the CFO, Director of IT, SVP of Security, and our General Counsel. On May 1, 2025, we added an outsourced virtual CISO who is a key advisor to the ITSRC, bringing over a decade of expertise in managing and maturing cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third-party security vendors, in collaboration with our Director of IT, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Security Policy and Requirements The Company has information security policies to (i) protect information processed and stored by the Company in accordance with applicable laws; (ii) protect the Company's information from current and emerging threats to computing systems and the energy industry in particular; and (iii) establish appropriate levels of protection for the Company's information systems. The IT Department is responsible for designing and implementing information system controls, procedures and solutions to accomplish the Company's cybersecurity and data protection objectives. The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, is responsible for (i) approving and reviewing any changes to the policies; (ii) ensuring necessary resources; (iii) defining information that is considered strategically important; (iv) reviewing and approving information security objectives on annual basis; and (v) driving continued improvement and communicating the importance of information security to the organization. All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department. We are regularly audited by certain customers to assess the adequacy of our cybersecurity controls.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: Our cybersecurity risk management program includes a Cyber Security Incident Response Plan ("CSIRP"). Our CSIRP supports the Company in identifying, containing, and tracking cybersecurity incidents experienced by us or our third-party service providers or suppliers. The CSIRP was established to minimize the impact of cybersecurity incidents on our networks, IT systems, users and business processes, and to ensure the timely and accurate reporting of material cybersecurity incidents, should they occur. The execution of our CSIRP is led by our Chief Information Officer and Head of Business Services ("CIO"), with support from a designated IT Incident Response Manager leading an Incident Response Team consisting of subject matter experts, as well as our Executive Response Team when appropriate. In the event of an incident, these individuals work together to assess its severity, notify and brief the appropriate team members, escalate to our Board of Directors as needed, and implement containment procedures. The Company also conducts tabletop exercises to enhance incident response preparedness and engage s third parties, including consultants and other professionals, on an as-needed basis to assess and support our cybersecurity practices and procedures.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors (the "Board") and management. Although cybersecurity risk oversight continues to remain a top priority for the Board, the Audit and Risk Committee of our Board has primary oversight responsibility for the Company's cybersecurity and other technology risks. The Committee regularly reviews and discusses with our CISO and our CCTO the Company's cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and any significant cybersecurity incidents, including recent incidents at other companies and the emerging threat landscape. The Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks. In addition, our Board receives an annual report and quarterly written updates regarding our cybersecurity program.

companyName: CHIPOTLE MEXICAN GRILL INC

ticker: CMG


text: Integration into the Overall Risk Management System Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (the "ERM") process. Cybersecurity risks are included in the risk universe that the ERM function evaluates to assess the most significant risks to the Company as a whole. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. Management presents quarterly the ERM risk assessment, including key risk indicators, to our board of directors.

companyName: Encompass Health Corp

ticker: EHC


text: Dedicated personnel support information security operations 24 hours per day, seven days per week. Allstate's incident response program is designed to detect, respond and recover from a range of cybersecurity-related incidents.

companyName: ALLSTATE CORP

ticker: ALL


text: Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, information systems, business operations, and products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), other global standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds, and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: Management Personnel responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Bill Roberts. With over 25 years of experience in the field of cybersecurity, Mr. Roberts brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: SideChannel, Inc.

ticker: SDCH


text: The Company has developed an information security program to address material risks from cybersecurity threats, which is integrated within our overall enterprise risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. Under the information security program, the Company performs one or more cyber risk assessments each year based on recognized industry best practices and standards and cyber threat intelligence. The risk assessments, together with risk-based analysis and judgment, are used to determine security controls to address identified risks. The Company considers the following factors, among others, during its risk and control implementation assessments: the likelihood and severity of the risk; the impact on the Company, the Company's customers, associates and stockholders, and others if a risk materializes; the feasibility and cost of controls; and the impact of controls on operations and others.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: We identify and assess areas of risk for our company on an ongoing basis, and we have developed, and regularly refine, comprehensive practices to manage and mitigate existing and potential risks to our business. Our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our chief information security officer ("CISO"), who reports directly to our chief information officer ("CIO"); • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data; and • a cybersecurity incident response plan.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Nucor recognizes the importance of developing, implementing, and maintaining effective cybersecurity measures designed to protect our information systems and the confidentiality, integrity, and availability of our data. We face a number of information technology and cybersecurity threats which could have an adverse effect on our business and results of operations.

companyName: NUCOR CORP

ticker: NUE


text: While we have not experienced material cybersecurity threats or incidents, or threats or incidents that are reasonably likely to materially affect us, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Information on cybersecurity risks and threats we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Our business is subject to cybersecurity risks and threats."

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: The Company has processes to identify risks from cybersecurity threats associated with its use of third-party service providers. Each third-party service provider is evaluated at onboarding for compliance with our cybersecurity standards. Risks identified through this assessment are logged and remediation plans are discussed with appropriate stakeholders.

companyName: PJT Partners Inc.

ticker: PJT


text: We do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: The Company acknowledges the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition, and reputation.

companyName: Toughbuilt Industries, Inc


text: Business continuity and disaster recovery plans are also a part of our cybersecurity process. Ensuring data continuity in times of disaster or other incidents is important so that proper security is followed in times of impact to our business. Our business continuity and disaster recovery plan includes a list of items that are essential to our business along with RTO and RPO information. The plan lists what each employee in the plan is responsible for and provides contact information.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process has included a review by our external partners, as appropriate.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems." Cybersecurity Governance.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: At the management level, oversight of our cybersecurity program rests with an internal committee comprised of the CIO, the Chief Legal Officer (CLO), and the Director of IT Security, who have in aggregate over 40 years of experience in assessing and managing cyber risks. The committee is responsible for overseeing the implementation and execution of our cybersecurity program and policies, and for engaging external experts as needed. The committee also reviews the log of security incidents as needed to validate that there are no materiality issues in the aggregate. The committee reports to the Audit Committee on a quarterly basis or more frequently as needed. We have an Incident Response Team comprised of IT, legal, and internal audit personnel that is activated with the help of other disciplines in the event of a perceived breach or security risk. The team is responsible for assessing the impact and materiality of the incident in accordance with a written Incidence Response Plan, determining the appropriate response and remediation actions, and communicating with internal and external stakeholders as needed.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Third-Party Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is audited periodically in accordance with our Board approved Internal Audit plan.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our board of directors has overall responsibility for evaluating key business risks faced by us, including cyber security and information technology. The audit committee of our board of directors assists the board of directors in the oversight and assessment of risks relating to data privacy, technology and information security, including cybersecurity.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: Recognizing the complexity and continuously developing nature of cybersecurity threats, Moelis periodically engages with a variety of external experts, including consultants, auditors and cybersecurity assessors in evaluating and testing our cyber risk management systems. Our collaboration with these third parties include, but are not limited to; threat assessments, consultation on security enhancements and regular periodic audits.

companyName: Moelis & Co

ticker: MC


text: Cybersecurity risk is integrated and managed as part of our broader enterprise risk management program under the direction of our Vice President – Chief Risk and Compliance Officer – who works closely with our Chief Information Officer and others, including the Head of our Cybersecurity & Privacy division to identify, review, assess and address cybersecurity and other security risks. Our Chief Risk and Compliance Officer, Chief Information Officer and the Head of our Cybersecurity & Privacy division are members of the Company's cybersecurity response team (the "Cyber Response Team"). The Cyber Response Team's responsibilities include maintaining a Cybersecurity Incident Response Plan, which sets out a path for how cyber threats and incidents are identified and escalated up to and including the Board of Directors and other leadership, when appropriate. Direct threats are escalated promptly to the appropriate team, following a path that considers both the nature of the threat, the level of risk, and the degree to which it has been substantiated. Indirect threats, such as third-party incidents, are escalated through the ITG to the appropriate corporate functions, as the situation warrants.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Our Chief Executive Officer, Assistant General Counsel, and Chief Accounting Officer provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 30 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various chief information officer roles with global companies.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk Committee of our board of directors reviews our cyber security risk profile on a quarterly basis. The Technology Committee and Risk Committee of our board of directors each provide a report of their activities to the full board of directors at each board meeting.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant per our established severity and response framework.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: periodic vulnerability assessment and penetration testing on shore and on vessels to review our cybersecurity weaknesses, using either internal competencies or external firms; a multi-vendor approach to reduce the risk of the compromise of a major cybersecurity vendor;

companyName: DORIAN LPG LTD.

ticker: LPG


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a cybersecurity program that endeavors to identify risks, protect assets, detect threats, respond to incidents, and recover from damaging events in a prompt and effective manner with the goal of minimizing business disruptions through effective governance of people, processes, and technologies. • External Collaboration: We collaborate with a third-party service provider to identify, assess, and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations, and sensitive information from cybersecurity threats, including compromises of our information systems and our data's confidentiality, integrity, and availability. These include firewalls, disaster recovery capabilities, malware and ransomware prevention, access controls, and encryption. • Education: We provide monthly training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities, and access of the relevant Company personnel. Our policies require all workers to report any actual or suspected cybersecurity events. • Incident Response Planning: We have established and maintain incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which a material incident would be communicated to executive management, our Board, external regulators, and shareholders. • Governance: Our Board's oversight of cybersecurity risk management is led by the Board's audit committee (the "Audit Committee"), which oversees our ERM program. The Audit Committee reviews cybersecurity threats, risks, and mitigation on at least an annual basis, and such reviews include internal and independent assessments of risks, controls, and overall program effectiveness.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, DISH Network experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.

companyName: EchoStar CORP

ticker: SATS


text: We continue to face significant and persistent cybersecurity risks and our business has both an increasing reliance on systems and an increasing digital footprint as a result of changing technologies, connected devices and digital offerings, as well as expanded remote work policies. We regularly assess our threat landscape and monitor our systems and other technical security controls, maintain information security policies and procedures, including a breach response plan, ensure maintenance of backup and protective systems, and have a team of security personnel managing our efforts and initiatives. We regularly review our policies, practices, and plans with assistance from third party experts and advisors for certification purposes, including with respect to System and Organization Controls 2 (SOC 2) certifications and Payment Card Industry Data Security Standard (PCI-DSS) certifications where relevant, and leverage third party resources to support our cyber risk defense, monitoring and response processes. We conduct security assessments and periodic re-assessments on third party partners and other service providers with access to information assets of Dover. In addition, we review independent audit reports from key third party partners and other service providers with access to information assets at least annually.

companyName: DOVER Corp

ticker: DOV


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, cybersecurity maturity assessments, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: As the Fund evaluates the materiality level of a data incident it will consider a variety of factors including the operational impact, the type of data impacted, how the data has been impacted, the business continuity and recovery procedures affected, the impact of the incident on the Fund's finances and any length of service interruption. Additional factors may also be considered given the nature of the event.

companyName: Wellings Real Estate Income Fund


text: Material Effects of Cybersecurity Incidents Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the Company based on the NIST CSF Framework. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented at the Company and measures the residual risk to ensure it is within the Company's risk tolerance.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Management acknowledges the potential risks associated with the use of third-party service providers. Therefore, management has established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom it engages. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to management's cybersecurity requirements. Management also maintains active communication channels with these providers to stay informed about any potential security incidents or concerns.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: In 2024, we achieved International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) 27001 certification. In 2025, we maintained our accreditation, reflecting our commitment to maintaining a robust information security management system. This internationally recognized standard demonstrates that we implemented risk-based controls to protect confidentiality, integrity and availability of critical data. The certification enhances our ability to manage cybersecurity threats, improve compliance posture and support customer trust in our information technology security practices.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: Our Senior Vice President of Information Technology is responsible for leading our company-wide cybersecurity strategy, policy, standards and processes and together with our whole information technology team works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.

companyName: Ameresco, Inc.

ticker: AMRC


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the audit committee of our board of directors (the "Audit Committee"). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact and cyber security awareness. These committees provide oversight and governance of the technology program and the information security program. These committees are chaired by department managers and include the Information Security Officer and Chief Technology Officer as well as their direct reports and other key departmental managers from throughout the entire company. These committees generally meet quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could have a material adverse effect on us including an adverse effect on our business, financial condition and results of operations.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third-party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response, and mitigation as appropriate.

companyName: Quanex Building Products CORP

ticker: NX


text: As discussed in more detail under the "Governance" heading, the Audit Committee provides oversight of the Company's cybersecurity risk management processes in collaboration with our Chief Information Officer, Chief Legal Officer, Vice President of Risk Management, information technology team and other internal and external experts.

companyName: WillScot Holdings Corp

ticker: WSC


text: We engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.

companyName: Block, Inc.

ticker: XYZ


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have, or are likely to, materially affect us, our business strategy, results of operations, or financial condition. For additional information concerning risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors in the category entitled, "Risks Related to Cybersecurity and Data Privacy".

companyName: Arista Networks, Inc.

ticker: ANET


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our Vice President of Information Technology who has over 15 years of extensive experience managing cybersecurity programs, who reports into our Chief Operating and Financial Officer. The Vice President of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Operating and Financial Officer is responsible for approving budgets, aiding in the preparation for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our board of directors oversees our risk management process, including as it pertains to material risks from cybersecurity threats, directly and through its committees. Board of directors' meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the CIO on our enterprise risk profile on an annual basis. The board of directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents. The board of directors plans, however, to delegate to its Audit Committee in the near future specific responsibility for overseeing our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe, including specific responsibility for overseeing material cybersecurity risk exposures. Specifically, the Audit Committee will be responsible for establishing risk tolerance guidelines around our cybersecurity posture, risk assessment, strategy and mitigation and for making recommendations related to the protection or privacy of our critical systems and data, and will take over the board of directors' functions in this regard as described above. The board of directors will continue to meet, at least annually, with members of our ACT to review and discuss our cybersecurity program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the board of directors and its committees.

companyName: QXO, Inc.

ticker: QXO


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information contained therein.

companyName: Legacy Education Inc.

ticker: LGCY


text: The establishment and development of PNGPL and PNRPL, each of which is a Botswanan entity, adds an additional regulatory framework within which the Company operates and is supplementary to the regulatory framework existing in Canada. The Company holds its interest in the Selebi Assets and the Selkirk Assets indirectly through its 100% owned subsidiaries, PNRPL and PNGPL respectively.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Impact of Cybersecurity Risks and Threats As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business, financial condition, results of operations or cash flows. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: Karat Packaging Inc.

ticker: KRT


text: The Company's Vice President of Finance and Technology ("VP FT"), assisted by the Company's Information Technology ("IT") Director and Cyber Security and Architecture Manager ("CSA"), is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The VP FT has more than eight years of experience overseeing and managing IT operations, including cybersecurity, within the mining industry and has extensive hands-on, practical experience navigating real-world cyber challenges. The Company's CSA has more than 25 years of IT, cyber security, and cyber auditing experience. The CSA holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.

companyName: SSR MINING INC.

ticker: SSRM


text: Management and Oversight As part of our cybersecurity program, we also engage with external service providers as part of our continuing cybersecurity efforts, assisting us in the evaluation and enhancement of the effectiveness of our information security policies and procedures. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity policies and procedures are comprehensive, up-to-date, and aligned with regulatory requirements.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the section of this Annual Report on Form 10-K titled "Risk Factors", including, but not limited to, the risk factor titled "If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of our product candidates' development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and cyber liability insurance that is intended to provide protection against the potential losses arising from a cybersecurity incident.

companyName: CorMedix Inc.

ticker: CRMD


text: The Board of Directors ("the Board") is acutely aware of the critical nature of managing risks related to cybersecurity threats. The CEO, CFO or CIO periodically briefs the Board on Davey Tree's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape, ensuring the Board has comprehensive oversight and can provide guidance on critical cybersecurity matters.

companyName: DAVEY TREE EXPERT CO


text: Valvoline has adopted a cross-functional and multi-management level approach to assessing and managing risks arising from cybersecurity threats. The Audit Committee of the Board (the "Audit Committee") oversees the Company's enterprise risk management program. As part of this oversight, the Audit Committee has primary responsibility for overseeing risks related to cybersecurity, although the Board retains ultimate oversight over these risks. The Board of Directors reviews and discusses cybersecurity risks along with the Company's cybersecurity programs and strategy with management. The Board of Directors receives reports and presentations from the Senior Vice President and Chief Technology and Cybersecurity Officer ("CTO") Vice President of IT Operations & Platforms, and Senior Director of Information Security during bi-annual meetings, and as needed, on a range of topics including, but not limited to, the cybersecurity program and processes, information systems, business risk identification and mitigation strategies, strategic updates, operational matters, the evolving cybersecurity threat landscape, regulatory developments, and notable incidents or threats affecting the Company.

companyName: VALVOLINE INC

ticker: VVV


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Human Resources and Technology Officer (the "CHRTO").

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Our board of directors delegates execution of our cybersecurity program to our Chief Information Security Officer, or CISO, who is responsible for the day-to-day management of our cybersecurity program. Our CISO has over 25 years of information security and information technology risk expertise in multiple industries, including financial, manufacturing, healthcare and life sciences, and holds industry standard certifications, including CISSP, CRISC and CISM. Our CISO, together with our Chief Information Officer, or CIO, provides at least two presentations each year to our board of directors or nominating and corporate governance committee on cybersecurity incidents, security program updates and ongoing risks, with additional updates being provided on an as-needed basis. Our CISO also meets periodically with our senior leadership team to review metrics on readiness, incidents, mitigations and remediation. In addition, our internal audit team performs periodic audits of our systems and cybersecurity processes, the results of which are reported to the audit committee and our senior management team.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Sensitive and confidential data is a part of business. Airship leverages an encryption and signing policy that identifies the type of information Airship stores and what level of encryption and signing is required for the data. This document also details the overarching requirements for encryption such as allowed cyphers, encryption methods, and key storage.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: As a wholly-owned subsidiary of WEC Energy Group, our cybersecurity-related risks are managed by WEC Energy Group's cybersecurity risk management program.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Recognizing the interconnected nature of the financial industry, we evaluate and monitor the cybersecurity practices of our third party service providers and partners using a risk-based approach. Our Third Party Oversight Department evaluates new and existing relationships based upon due diligence requirements defined by our Cybersecurity Department to understand and mitigate material risks associated with third party service providers and partners. Risk assessments and audit results in connection with our Cybersecurity Program are reported to senior management and the Board of Directors. Risk owners from our Cybersecurity Program develop risk mitigation plans to resolve any cybersecurity risks identified in risk assessments or audits.

companyName: Bancorp, Inc.

ticker: TBBK


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management and our board of directors.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also utilize a managed security provider (the "Security Provider") to identify and assess vulnerabilities. Our Security Provider monitors our network, does vulnerability scanning, provides event logging services, and raises potential and actual threats with the Company's security operations center when appropriate.

companyName: FARO TECHNOLOGIES INC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: We have conducted a cyber security risk assessment performed by a third-party consultant and are in the process of developing a formal cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The risk assessment was performed against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") standards.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: This program includes an incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We periodically conduct cross-functional tabletop training exercises to rehearse our response to cyber-related breach incidents or other major security events. We also mandate information security awareness training for all employees, along with testing employee readiness through phishing simulations and providing periodic security information updates.

companyName: EXP OldCo Winddown, Inc.


text: We leverage the cybersecurity services of third-party vendors, including a third-party managed services provider and IT consultants, to support our cybersecurity risk management program and assist us in conducting external cybersecurity risk assessments. As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. As part of our vendor diligence process we require vendors with access to our information technology systems and infrastructure to complete information security program questionnaires.

companyName: Septerna, Inc.

ticker: SEPN


text: Since our commencement of operations, we have not experienced a material information security breach incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Other Risks—Due to the increased use of technologies, intentional and unintentional cyber-attacks pose operational and information security risks."

companyName: VanEck Bitcoin ETF

ticker: HODL


text: In addition, our Incident Response process is designed to ensure that the Board receives timely notifications and reports, particularly with respect to any material cybersecurity incident, so that they are aware of any material incident and can provide oversight and direction as part of the response and remediation process.

companyName: Rumble Inc.

ticker: RUM


text: Our executive management team, in collaboration with our managed information technology service provider, is responsible for assessing and managing cybersecurity risks to the Company, including our Confidential Information and Critical Systems. The team holds primary responsibility for our cybersecurity risk management program and works closely with our IT service provider to ensure its effective implementation.

companyName: Hour Loop, Inc

ticker: HOUR


text: Our cybersecurity team works in conjunction with management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. The Chief Executive Officer is responsible for overseeing our information technology leadership team and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership team reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.

companyName: IRADIMED CORP

ticker: IRMD


text: Risk Management and Strategy AFG recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats as defined by the Securities and Exchange Commission. Like all businesses, AFG is a target for "cyberattacks," "ransomware," "phishing," "hacking" and similar illegal or unauthorized intrusions into computer systems and networks. Such events can result in significant disruptions to information technology systems, the theft of information and financial assets and reputational harm. AFG could also incur significant expenses associated with investigating and remediating any such event.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: The following disclosure outlines the Company's cybersecurity risk management strategy, governance structure, incident response procedures, regulatory compliance efforts, and ongoing investments in cybersecurity.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: On a quarterly basis, the Audit Committee discusses with senior management, our processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of our cybersecurity processes. The Audit Committee also receives updates on, and monitors, our prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: To foster a culture of cybersecurity awareness within the Company and provide employees with further knowledge of cybersecurity-conscious behavior, all employees of the Company are required to attend cybersecurity training sessions during the onboarding process and at least once per year.

companyName: Mobileye Global Inc.

ticker: MBLY


text: We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: VOLITIONRX LTD

ticker: VNRX


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Paragon 28, Inc.


text: The Cybersecurity Executive Leadership Team is composed of the CIO, in coordination with our Chief Executive Officer, or CEO, Chief Financial Officer, or CFO, Chief Compliance Officer and General Counsel, or GC. The team works collaboratively across our company to design and implement programs to protect our information systems from cybersecurity threats and to appropriately respond to any cybersecurity incidents in accordance with our cybersecurity incident response plan. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout our company are engaged to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CIO and the Cybersecurity Executive Leadership Team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: VERACYTE, INC.

ticker: VCYT


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors included in Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K, including "Risk Factors — Risks Related to our Business — A breakdown, corruption or breach of our information technology systems or computer systems, or those used or hosted by our CROs, contractors, consultants or third-party vendors could subject us to liability or interrupt the operation of our business."

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: Cybersecurity Risks As of April 15, 2025, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition, or are reasonably likely to have such a material effect. However, like all organizations, we face potential risks from cybersecurity threats which could materially affect our operations or financial condition if they were to occur.

companyName: OZOP ENERGY SOLUTIONS, INC.

ticker: OZSC


text: The Audit Committee is also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee provides another level of cybersecurity oversight through engagements at each Audit Committee meeting with senior management, including our Global Chief Information Officer and the Senior Director of Information Security. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Audit Committee regularly reports to the Board regarding these matters.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: The Director of IT is promptly informed of potential cybersecurity risks, threats, and vulnerabilities by the Company's IT Helpdesk. Once an incident has been identified, the Director of IT and the IT network security team assess the criticality and impact of the incident on the Company's business operations. The Director of IT then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the senior leadership on all material incidents.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: D.R. Horton's CSRO has 24 years of experience working in information technology and cyber security roles including software development, identity and access management projects, privilege account management and multifactor authentication implementations. While in those roles, the D.R. Horton CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The D.R. Horton CSRO currently reports to the D.R. Horton CIO.

companyName: Forestar Group Inc.

ticker: FOR


text: We have developed and implemented an information security and cybersecurity risk management program ("Program") intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems. Our Program takes a risk-based approach and is integrated into our overall enterprise risk management program. We use the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") as a benchmark to ensure that our Program is maintained in line with industry best practices. This does not imply that we meet any particular technical standards, specifications or requirements, but it does mean that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: Our management team has overall responsibility for assessing and managing material risks from cybersecurity threats, and for executing on our cybersecurity risk management processes. Our Chief Technology Officer, Chief Information Officer and Chief Information Security Officer, among others, have decades of combined experience in areas such as information technology, compliance, and cybersecurity program design and management. Additionally, certain leaders and personnel within the cybersecurity operations team hold industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager. Our management team works closely with our cybersecurity operations team to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT, Operational Technology (OT), and products and services environments.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Significant disruptions to our information technology systems or breaches of information security could adversely affect our business. We are increasingly dependent on sophisticated information technology systems and infrastructure to operate our business. Occasionally we also outsource elements of our operations to third parties, some of which are outside the U.S., including elements of our information technology infrastructure, and as a result we are managing many independent vendor relationships with third parties who may or could have access to our confidential information. The size and complexity of our information technology systems, and those of our third-party vendors with whom we contract, make such systems potentially vulnerable to service interruptions. In addition, we and our vendors could be susceptible to third party attacks on our information technology systems. Such attacks are increasingly sophisticated and are made by groups and individuals with a wide range of motives and expertise, including state and quasi-state actors, criminal groups, "hackers" and others. Any security breach or other disruption to our or our vendors' information technology infrastructure could also interfere with or disrupt our business operations, including our manufacturing, distribution, R&D, sales and/or marketing activities.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: We face various cybersecurity risks, including unauthorized access, information leakage, malware and viruses, technical disruption, and insider threats. Identifying, assessing, and managing these risks is the foundation of our comprehensive cybersecurity framework and is integrated into our overall risk management systems and processes. We have implemented strong access controls, regular security assessments, vulnerability management, user education and awareness, monitoring, threat intelligence (including user behavior analytics), and managed detection and response to mitigate cybersecurity risks.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: The HIS and CIO, in coordination with our management team, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Through an ongoing process, the HIS monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the CIO, management team, and when appropriate, the Audit Committee.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Recognizing the critical importance of robust cybersecurity measures, the Company is committed to developing, implementing and maintaining measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: CoJax Oil & Gas Corp

ticker: CJAX


text: The Company maintains policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and has integrated these processes into the overall risk management processes. The Company has programs in place intended to address and mitigate the cybersecurity risks that could adversely impact customers and/or reputation and lead to financial losses from remediation actions, loss of business, production downtimes and operational delays. These programs include regular monitoring of outside threats, continuous updating of software to mitigate risk, education of employees to the risks of external threats, a simplification of infrastructure to minimize servers and migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers.

companyName: KOSS CORP

ticker: KOSS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: CARGO Therapeutics, Inc.


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to, and completed by, all of our employees on an annual basis, which is tracked and recorded throughout the year. Results are shared with executive management, the Audit Committee, and the Board of Directors. Additionally, employee phishing tests are conducted on a regular basis.

companyName: A10 Networks, Inc.

ticker: ATEN


text: Our board of directors, in coordination with our internal Risk Committee, oversees our ERM function, including the management of risks arising from cybersecurity threats. Our board of directors receives regular updates on cybersecurity matters from management's Risk Committee and from the Information Security Committee, which is comprised of Information Technology and Security leadership and oversees operational aspects of our cybersecurity program. Those updates to our board of directors address a wide range of topics that may include information on recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and information security considerations with respect to our partners and third parties. Our board of directors and management's Risk Committee also receive prompt information regarding any cybersecurity incident that meets established reporting thresholds and ongoing updates on any such incident until it has been addressed. Our Information Security Committee and vCISO annually report on the status of our cybersecurity program and meet with our board of directors to discuss our approach to cybersecurity and risk management.

companyName: TRUPANION, INC.

ticker: TRUP


text: The Company's third-party intake process incorporates cybersecurity risk into the assessment of our third-party vendors when we engage a new vendor or experience a change in relationship with an existing vendor. Further, the Company's cybersecurity team conducts reviews of its third-party vendors depending on the vendor's risk profile as determined by its cybersecurity team.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Each employee plays a role in safeguarding our data assets, and the protection of our data is ingrained in every employee's day to day activities. Employees must participate in annual Cyber Security training. Simulated testing occurs multiple times throughout the year, including drop testing and SPAM / PHISHING campaigns, and the results are tracked for compliance and we address any weaknesses identified in such trainings and testings as necessary.

companyName: Mistras Group, Inc.

ticker: MG


text: The HEI CFO oversees all IT and cybersecurity matters at HEI, including having oversight responsibility for the services delivered under the SLA. Since the HEI CFO does not have the expertise in cybersecurity, the HEI CFO works with the Hawaiian Electric CISO and, if necessary, with third-party cybersecurity consultants on assessing, identifying, and managing material cybersecurity matters impacting HEI. There were no cybersecurity incidents that have materially affected or are reasonably likely to materially affect HEI, including its business strategy, results of operations or financial condition.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee. The cybersecurity program is overseen by the Mosaic's CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic. The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and retail sectors. Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional. During the course of leadership team's careers, they have built and sustained programs protecting other Fortune 500 companies, critical national infrastructure and military defense systems.

companyName: MOSAIC CO

ticker: MOS


text: As of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably anticipated to have a material adverse effect on our business. However, we have experienced and expect to continue to experience cybersecurity threats and cybersecurity incidents. As an example, in December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers. We are committed to maintaining robust governance and oversight of cybersecurity risks and implementing recognized industry best practices to help prevent, detect, mitigate and respond to these risks; however, we cannot provide assurance that cybersecurity risks will not materially affect our business in the future, including our business strategy, results of operations, or financial condition or that our controls, processes and procedures will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: We continuously monitor, assess, and strategically invest to improve the effectiveness and resiliency of our information security systems to keep abreast of the dynamic and complex cybersecurity landscape.

companyName: PRICESMART INC

ticker: PSMT


text: Our Cybersecurity and Technology Risk Program (the "Program") is designed to protect critical assets, scale with business growth, and identify and mitigate threats, enabling us to securely conduct the Company's business. The Program's design applies concepts from the frameworks of the National Institute of Standards and Technology ("NIST") as guidelines, incorporating their applicable principles while adapting certain elements to align with our specific operational needs and objectives. The Program and other cybersecurity processes have been integrated into our overall risk management framework.

companyName: PJT Partners Inc.

ticker: PJT


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its finding with the company Audit Committee. The CISO and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: The members of the Company's management that are primarily responsible for assessing and managing risks from cybersecurity threats, including monitoring risk appetite metrics and limits related to cybersecurity, include the Company's CISO, Chief Risk Officer, and Chief Information and Technology Officer.

companyName: US BANCORP \DE\

ticker: USB


text: The Company partners with third-party service providers and employs processes to assess, identify, and manage material risks from cybersecurity threats arising from the use of such third-party service providers. Our latest assessment attempted to identify vulnerabilities in our network and systems from external, internal, and social engineering perspectives. Our cybersecurity practices (including with respect to third-party service providers) have been assessed to represent a level of maturity consistent with industry best practices.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The Head of Product and Operations then formulates and oversees a response to contain, eradicate and resolve incidents in accordance with the Company's incident response plan. Management is responsible for reporting incidents to the appropriate authorities as necessary and engaging the senior leadership on all material incidents.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Regardless of the controls we have in place, cybersecurity risks continue to become more complex and pervasive, and our internal controls cannot provide absolute assurance that we will be able to protect ourselves from significant cyberattack incidents. Additionally, by outsourcing certain administrative functions to third parties, we may be exposed to risk of data security breaches against those third parties.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Cybersecurity risk management is an integral part of the Corporation's enterprise risk management program. The cybersecurity risk management program is designed to align with industry best practices, is generally based on the framework established by the National Institute of Standards and Technology (NIST), provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications and services provided by third parties, and facilitates coordination across different departments of the Corporation. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a threat, including whether the threat is associated with a third-party service provider, implementing countermeasures and mitigation strategies, and informing management and the Board of Directors of material cybersecurity threats, incidents, and impact.

companyName: HNI CORP

ticker: HNI


text: As referenced above, the CIO provides information security updates to the Board of Directors at each Board meeting. Additional information security training to the committee is provided through a management Information Security Steering Committee and also through targeted training overseen by the CIO. In addition, as discussed below, the Company has implemented an Incident Response Plan, which is integrated into its Cybersecurity Policy, to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and is subject to annual review and approval by the Board of Directors. Cybersecurity metrics are reported to both management level committees and the Board of Directors on a monthly basis.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: • Ongoing Evaluation and Assessment of Systems and Processes. We update our information security management system from time to time as appropriate and we employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks. • Security Awareness Program to Train and Test Personnel. We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Cyber Incident Response Plan. We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the ECS team would escalate the issue to the Council for initial analysis and guidance. In the event of a significant breach, the CIRT, overseen by the Council, would typically be tasked with preparing an initial response. The Council (in consultation with, among others, the CIRT) would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The ECS team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, the results of our recent ECS initiatives, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: ON SEMICONDUCTOR CORP

ticker: ON