text: Incident Management. We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure. For a discussion of whether any cybersecurity risks have, or are likely to materially affect us, please see 1A, Risk Factors, for a discussion of identified cybersecurity risks.

companyName: OneSpan Inc.

ticker: OSPN


text: These measures aim to prevent, detect, and respond to cybersecurity incidents effectively. They are regularly reviewed and updated to adapt to evolving threats.

companyName: UFP INDUSTRIES INC

ticker: UFPI

secItem: Item 1C


text: The CISO chairs the Company's Cybersecurity Oversight Council, a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The Cybersecurity Oversight Council is sponsored by the Company's Global General Counsel and CIO and is composed of senior leaders from our privacy, legal, information technology, cybersecurity, internal audit, and global security and asset protection functions, among others. Subject matter experts are also invited, as appropriate. The Cybersecurity Oversight Council meets at least quarterly and has responsibility for oversight and validation of the Company's cybersecurity strategic direction, risks, threats and priorities. The Cybersecurity Oversight Council acts in alignment with the Company's Risk Steering Committee, another cross-functional management committee, which provides strategic direction and oversight over the Company's ERM program. The CISO and his team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the Company's cyber incident response plan.

companyName: COCA COLA CO

ticker: KO


text: We have identified and, as appropriate and when we have the budget to do so, will utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Ocean Biomedical, Inc.

ticker: OCEA


text: Risk Identification and Assessment. Regions devotes significant financial and non-financial resources to identify and mitigate threats to the confidentiality, availability and integrity of its information systems. As more fully described below, the Regions IS Program's controls and risk management practices are designed to prevent and detect cybersecurity threats in order to reduce the likelihood that they materially affect Regions' business strategy, operations, or financial condition.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: We maintain insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cybersecurity attack or a security breach. Such insurance is subject to several exclusions and may not cover the total loss or damage caused by an attack or a breach. Consequently, costs related to incidents may not be covered by insurance.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: _____________________________________________________________________ Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take annual cybersecurity training and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of the cybersecurity training. We also periodically conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments led by Internal Audit to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: The cybersecurity threat landscape is dynamic and volatile and requires significant investment. To date, risks from cybersecurity threats have not materially affected, and we do not believe are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. As discussed more fully under Item 1A, Risk Factors in this Annual Report on Form 10-K, although our processes are designed to help identify, detect, prevent, respond to, and mitigate cybersecurity risks, cybersecurity threats are rapidly evolving and we may not be able to anticipate, prevent, or detect all such attacks and there is no guarantee that a future cybersecurity incident could not materially affect our business strategy, results of operations, or financial condition.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Management's Role in Cybersecurity Risk Management The Adviser's Director of IT and internal cybersecurity team are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO, are responsible for assessing and managing material risks from cybersecurity threats that impact the Company. The Adviser's Director of IT has more than 25 years of experience advising on and managing risks from cybersecurity. The Adviser's Director of IT works closely with Company management to administrator, assess, discuss, and prioritize the Company's cybersecurity efforts. The Company's Chief Compliance Officer oversees the Company's oversight function generally and relies on the Adviser's Director of IT to assist with assessing and managing material risks from cybersecurity threats. The Company's Chief Compliance Officer has been responsible for this oversight function as Chief Compliance Officer since his appointment and has worked in the financial services industry for more than 15 years, during which time the Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Company.

companyName: Stone Point Credit Corp


text: Our IT department maintains policies and procedures regarding network security, data protection and incident response. Pursuant to those policies, IT engages with the Chief Financial Officer, General Counsel and other experts when assessing cybersecurity threats, incident response, and making disclosure determinations following a data or network breach. The Vice President, IT is accountable at the management level for our overall IT risk management program. Additionally, our Chief Executive Officer and Audit Committee receives regular updates from the Chief Financial Officer, General Counsel and the Vice President, IT about significant threats and incidents involving cybersecurity and data protection, as well as security enhancements made to our IT infrastructure.

companyName: Celcuity Inc.

ticker: CELC


text: The Audit and Risk Committee (the "Audit Committee") of our Board is responsible for the oversight of risks from cybersecurity threats. On a quarterly basis, our CISO updates the Audit Committee on the Company's IT security program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics. This quarterly update is also made available to the full Board, and the Chair of the Audit Committee informs the Board of any key updates during quarterly reports to the Board. Material cybersecurity risks are also considered during Board and Committee discussions of matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters. The Board periodically conducts education sessions on cybersecurity trends and risks.

companyName: MSCI Inc.

ticker: MSCI


text: Our team responsible for monitoring and assessing cybersecurity threats, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity.

companyName: GAXOS.AI INC.

ticker: GXAI


text: We have no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Papaya Growth Opportunity Corp. I


text: We maintain relevant in-house cybersecurity expertise, led by the Bank's Information Security Officer ("ISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"). The ISO oversees cybersecurity-related activities, including risk assessments, service provider oversight, incident response, business continuity, staff training, and security program adjustments based on evolving threats. The ISO has more than 20 years of information security experience at financial institutions as well as information security consulting firms, and maintains various cybersecurity and IT audit professional certifications. The ISO works in partnership with the Company's Information Technology department and is supported by both internal and external information technology and information security tools, resources and staff.

companyName: First Financial Northwest, Inc.


text: Roles and Responsibilities of Management Our cyber security team, which reports to the Vice President - Technology, has primary responsibility for cybersecurity strategy and assessing cyber risk. The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team. Collectively, our cyber security team has experience in cybersecurity, hold numerous industry certifications related to cybersecurity, and have experience in desktop support, networking, application administration and programming.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: The potential impact of cybersecurity threats on our business strategy, operations, and financial condition is discussed under specific headings in our risk factor disclosures at Item 1A and in the Management's Discussion and Analysis of Financial Condition and Results of Operations at Item 7 of this Annual Report on Form 10-K.

companyName: ARTIVION, INC.

ticker: AORT


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations and the services we provide to clients as well as loss, misuse or theft of personal information (candidates, associates, vendors, clients and employees) and other data, confidential information or intellectual property, and we have experienced data exposures in the past. However, to date these incidents have not had a material impact on our services, information systems or business. Any significant disruption to our services or access to our systems could result in a loss of clients and adversely affect our business and results of operation. Further, a penetration of our information systems or a third-party's information systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See Item 1A of Part I, "Risk Factors," under the heading "We could incur liabilities or suffer reputational damage from a cyberattack or improper disclosure or loss of personal or confidential data, and our use of data is subject to complex and ever-changing privacy and cybersecurity legal requirements that could negatively impact our business or subject us to claims and/or fines for non-compliance," which should be read in conjunction with the information above.

companyName: ManpowerGroup Inc.

ticker: MAN


text: The CISO has served in various roles in information technology and information security for many years and holds relevant professional certifications. The Adviser's COO and CCO each hold educational and professional degrees in their respective fields, and each has numerous years of experience managing risk at the Company and at similar companies, including assessing cybersecurity threats.

companyName: TCW Direct Lending VIII LLC


text: We have implemented technical solutions that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality, and access controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, information technology, legal, compliance and ethics and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application security and delivery products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation."

companyName: F5, INC.

ticker: FFIV


text: We believe our cybersecurity governance, risk management processes and incident response program provide a strong foundation for managing risks, but no cybersecurity program can eliminate all risks entirely. We will continue to evolve our defenses in line with industry developments and regulatory expectations.

companyName: ALEXANDER TECH CORP


text: We utilize a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented an approach to identify and mitigate information security risks that we believe is commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. From the completion of the Company's separation from Crane Holdings on April 3, 2023. Since the separation and during the past five years (as Crane Holdings), no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond.

companyName: Crane Co

ticker: CR


text: As of the date of this Annual Report on Form 10-K, we are no t aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: HeartSciences Inc.

ticker: HSCS


text: We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.

companyName: Natics Corp.

ticker: NTCS


text: The Information Security team actively manages cybersecurity threats and incidents through comprehensive technical tooling, reporting, partnerships, and processes. Intrusion prevention, detection, and response systems, access management systems, and incident and vulnerability management systems are all examples of technical tools employed by First Solar's Information Security team to protect our information technology environment. Our incident response plan includes specific criteria for determining the potential impact of an identified cybersecurity incident and defined escalation protocols to determine which internal and external stakeholders should be involved and the appropriate communication channels, including considerations of any reporting based on regulatory requirements. Further, at least annually, certain key members from our Information Security team engage in cybersecurity tabletop exercises alongside certain members of both our executive team and board of directors, which are designed to simulate a cybersecurity threat or incident to test First Solar's incident response plan. Cybersecurity incidents are evaluated on a case-by-case basis and are categorized as low, moderate, or high impact incidents depending on qualitative and quantitative factors, including, but not limited to, their operational impact, degree of compromise, legal or regulatory impacts, and data disclosure impacts. The audit committee of the board of directors is notified if a potentially material incident is identified and reviews our response to material cybersecurity incidents, including disclosure considerations and the engagement of forensic and other technology experts to ascertain the extent of the incident, remediation actions, and responsive measures to prevent or mitigate future incidents.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: We regularly engage certified and reputable consultants and auditing firms to evaluate the maturity and effectiveness of our security, including testing the design and operational effectiveness of controls, penetration testing, engaging in independent reviews of policies and standards, and consulting on best practices.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: As part of our cybersecurity risk management program, we maintain processes related to third-party vendor cybersecurity risk management. As appropriate, we contractually require certain third-parties to certify that they have the ability to implement and maintain appropriate cybersecurity measures, consistent with applicable laws, and to promptly report any suspected cybersecurity incidents that may affect our company or our data.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: We work with third-party service providers from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: The Cybersecurity Risk Committee reports to the Operational Risk Committee which is part of our overall risk management framework. The Operational Risk Committee is responsible for incorporating risk management considerations into our business activities. The Operational Risk Committee reports to the Executive Committee, our principal management-level policy-making committee that reports directly to the Board. Under the Plan, the Executive Committee is responsible for escalating and informing the Board about significant cybersecurity incidents and steps being taken by management to address them.

companyName: PJT Partners Inc.

ticker: PJT


text: ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN brands align to the Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CMMC 2.0 framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services.

companyName: ASGN Inc

ticker: ASGN


text: employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and cybersecurity risk insurance. also seek to engage reputable service providers that maintain cybersecurity programs or controls.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: We use a cross-functional approach to identifying, preventing, assessing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of cybersecurity incidents and support appropriate public disclosure and reporting of incidents as required in a timely manner.

companyName: VEEA INC.

ticker: VEEA


text: Axel Schwan. Mr. Schwan, age 51, was appointed as President, Tim Hortons Canada & US in October 2019 after serving as Global Chief Marketing Officer for Tim Hortons since October 2017. Mr. Schwan first joined RBI as Marketing Director, Germany, Austria and Switzerland in 2011 and was then appointed as Vice President, Marketing and Communications, EMEA for Burger King before advancing to the role of Global Chief Marketing Officer for the brand in January 2014. Prior to joining RBI, Mr. Schwan led the Schwan family restaurant business, alongside his sister, and worked in various marketing roles at Unilever and Danone in Germany.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We, like many organizations operating in the current climate, face significant cybersecurity threats. To date, no risks from cybersecurity threats or incidents have materially affected us, including our results of operations or financial condition. Notwithstanding our security awareness program, we may not be successful in identifying a cybersecurity threat or preventing or mitigating a cybersecurity incident or vulnerability, which if realized, could materially affect us. Additional information on the cybersecurity risks we face can be found in Item 1A. "Risk Factors—Technology, Data Security, Cybersecurity, Business Continuity and Disaster Recovery Risks" of this Annual Report on Form 10-K.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. This includes multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our Chief Information Security Officer and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our Chief Information Security Officer has twenty-five years of cybersecurity experience, has completed a Masters in Information Security Engineering, and holds several cybersecurity certifications.

companyName: MAXLINEAR, INC

ticker: MXL


text: The cybersecurity threat landscape is volatile and dynamic, requiring a robust and resilient framework to reduce and mitigate cybersecurity risk. Our cybersecurity risk includes exposure to failures or interruptions of service or security breaches resulting from malicious technological attacks that impact the confidentiality, integrity, or availability of our or third parties' operations, systems, or data. We seek to mitigate cybersecurity risk and associated reputational and compliance risk by, among other things: leveraging the National Institute of Standards and Technology framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover; maintaining privacy policies, management oversight, accountability structures, and technology design processes to protect private and personal data;

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: As previously disclosed, on September 14, 2023, we announced that an unauthorized actor had gained access to our information technology network as a result of a social engineering attack on an outsourced IT support vendor used by the Company, and acquired a copy of, among other data, our loyalty program database, which includes driver's license numbers and/or social security numbers for a significant number of members in the database ("Data Incident"). After detecting suspicious activity in our information technology network, we activated our IRP, which included containment measures, and commenced an investigation of the incident. We also notified law enforcement and state gaming regulators, engaged legal counsel and other third-party incident response and cybersecurity professionals, as well as forensic professionals.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Cybersecurity risk management is an integral part of overall enterprise risk management. As part of its enterprise risk management efforts, the Board of Directors meets with the executive leadership team to assess and respond to critical business risks. These assessments include a review of our cybersecurity programs, as well as an overview of trending cyber threats based on industry intelligence and potential mitigation strategies. Performing these assessments regularly enables the Company to determine key business objectives and the IT assets and capabilities needed to achieve them. In addition, the assessments also provide the executive leadership and the Board of Directors an understanding of the Company's security landscape and allows it to prepare to respond to threats. Cybersecurity threats continue to be identified as one of the Company's significant risks, with our VP of Tech assigned as the risk owner. Our VP of Tech has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data analytics and customer service through his eighteen years of experience in the information technology space including over thirteen years in senior leadership roles. He is currently a Certified Information Systems Security Professional (CISSP) and he holds a Master's degree in Software from the University of St. Thomas.

companyName: AIR T INC

ticker: AIRT


text: The Company has processes designed to provide reasonable oversight for the identification of cybersecurity risks associated with certain third-party service providers. As appropriate, the Company requires certain third-party providers to complete a cybersecurity questionnaire, to provide Service Organization Control assessment results, if such results exist, or to agree to contractual language regarding cybersecurity and incident notification obligations in agreements with the company. CSX also has processes that help monitor risks associated with its key third-party vendors' technology systems, including, where appropriate, performing security assessments of cyber incidents through dashboard alerting for reported events. CSX's internal cybersecurity processes and disclosure protocols consider cybersecurity incidents involving key applications provided by third-parties.

companyName: CSX CORP

ticker: CSX


text: Finally, we have implemented encrypted virtual private networks in an effort to enhance the integrity of remote connections and have endeavored to protect wireless access points to our systems using authentication of users and/or devices. Segmented networks and user access controls are used to limit unauthorized access to sensitive information and systems. Employees are required to use multi-factor authentication and regularly update their passwords.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Hosting in-house production systems in geographically dispersed locations that are backed up to alternate locations; and Employee cybersecurity awareness training that includes regular phishing simulations.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any cybersecurity incidents.

companyName: Vertex, Inc.

ticker: VERX


text: The cybersecurity councils, cybersecurity management teams and materiality assessment teams include members with decades of operational experience as cybersecurity professionals as well as management with decades of service in the areas of information and operational technology and legal, compliance, financial reporting and enterprise risk management. Some of these members hold relevant degrees and certifications that we believe enhance our ability to manage and respond to cybersecurity risks, including, among others, bachelor's and/or master's degrees in cybersecurity and computer science as well as certified information systems security professional, certified incident handler, and certified information security manager certifications.

companyName: SEMPRA

ticker: SREA


text: Like other financial services firms, Truist faces an increasingly complex and evolving cybersecurity threat environment. See Item 1A, "Risk Factors" for information on risks from cybersecurity threats. We maintain a risk-based cybersecurity framework that is part of our ERM Framework. It is implemented through people, processes, and technology, whereby we assess, identify, and manage material risks from cybersecurity threats, and seek to adapt our risk mitigation activities accordingly.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: We adhere to a risk management framework based on applicable laws and regulations to handle cybersecurity risks across our products, services, infrastructure and corporate assets. We regularly conduct risk assessments to gauge the effectiveness of our systems, identifying areas for improvement. These processes enable us to make informed, risk-based decisions and prioritize cybersecurity measures and risk mitigation strategies. Our risk mitigation efforts encompass a range of technical and operational actions.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: Task Force ultimately provides information to our Audit Committee regarding its activities, including those related to cybersecurity risks. The Audit Committee also receives a briefing and continuing education from a member of the Task Force relating to our cyber risk management program at least annually. The Task Force is responsible for notifying the Audit Committee of material cybersecurity incidents.

companyName: American Bitcoin Corp.

ticker: ABTC


text: Impact of Recent Cyber Incident While the previously disclosed ransomware incident led to (i) temporarily delayed invoicing that impacted the timing of cash collections and free cash flow in 2022 and (ii) customer implementation delays in 2022, as the Company recovered from the impacts of the ransomware incident, substantially all delayed implementations due to the ransomware incident were completed as of the end 2022. Furthermore, any delayed or impacted processes have returned to normal operations. To date, the Company does not believe the ransomware incident, or other identified cyber risks, have had, or will have, a material adverse effect on its business, operating results, cash flow, or financial condition.

companyName: OMNICELL, INC.

ticker: OMCL


text: The company maintains a structured cybersecurity risk-management framework focused on identifying, assessing, and mitigating material risks from cybersecurity threats within its digital payments division, HammerPay. HammerPay's platform architecture, which supports regulated payment processing, prepaid merchant card issuance, and digital wallet operations, is continuously monitored to protect customer data and transaction integrity. The Company conducts continuous threat detection, routine penetration testing, and access-control audits, while incident-response protocols are coordinated by the Compliance and IT Security teams.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: The Board of Directors oversees the work of all its committees, including the Audit and Finance Committee. The Audit and Finance Committee is responsible for, among other things, overseeing the Company's financial disclosures and its internal and external audit functions, maintaining the integrity of financial reporting and internal controls, and providing stewardship and guidance to management in its approach to the assessment and mitigation of cybersecurity risks. The Chief Information Officer ("CIO") provides annual and periodic updates to the Audit and Finance Committee and the Board of Directors on cybersecurity risks and the Company's strategy for mitigating such risks. Additionally, the Chief Information Security Officer ("CISO") briefs the Audit and Finance Committee periodically. The Audit and Finance Committee also receives updates on information systems and cybersecurity audit and advisory engagements from the Chief Internal Auditor.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: The CISO has served in various roles in information technology and information security for over 15 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in Information Networking and Telecommunications, a graduate degree in Cybersecurity, and has attained the professional certification of Certified Information Systems Security Professional. The CIO holds an undergraduate degree in Business Finance and has served in various roles in information technology for over 30 years, including serving as either the Chief Information Security Officer or Chief Information Officer of two public companies.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Security and privacy reviews designed to identify risks from new features, software, suppliers, and vendors; • A vulnerability management program designed to identify software vulnerabilities; • A variety of tools designed to monitor our networks, systems, and data for suspicious activity; • An internal red team program that simulates cyber threats, enhancing our ability to fix vulnerabilities before they are exploited by threat actors; • A threat intelligence program designed to model and research our adversaries; • Products and services to structure, test, and assess the rigor of our software security practices; • A variety of privacy, cybersecurity, and incident response trainings and simulations, including mandatory yearly training for all employees, additional training for all Information Technology and Information Security personnel, and regular controlled penetration testing and cyber incident exercises to test the robustness of our data security protections and incident response readiness; • For suppliers and service providers, pre-engagement risk-based diligence, contractual security and notification provisions, and ongoing monitoring as appropriate; and • Maintaining cyber liability insurance that covers certain liabilities related to data breaches and related incidents.

companyName: SYNOPSYS INC

ticker: SNPS


text: Engagement of Third-Parties Recognizing the complexity and evolving nature of cybersecurity threats, we may periodically engage a range of external experts, including cybersecurity assessors, consultants, and auditors to evaluate and test our information systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes generally follow industry-recognized standards and frameworks, and are compliant with applicable laws.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Scripps is committed to data governance and protection. We recognize the importance of safeguarding personal information in today's digital landscape. Our comprehensive Privacy Policy provides a clear definition of "personal data" and outlines where and how the policy applies. The policy details our methods for collecting and storing personal data, explains users' rights and addresses additional privacy-related matters. We maintain transparency by keeping our Privacy Policy updated and making it available across all relevant digital platforms.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: We have established and implemented processes to assess, identify and manage material cybersecurity risks. Cybersecurity risks are assessed, identified, and managed by our Executive Director of Cybersecurity and Infrastructure, with direct supervision by our Vice President and Chief Information Officer ("CIO") and with the assistance of our internal audit and legal teams. Our Executive Director of Cybersecurity and Infrastructure shares information regarding such risks with our management's senior level information security council (the "Information Security Council"), which consists of our CIO, Senior Vice President and Chief Financial Officer, Vice President and Chief Technical Officer, Senior Vice President and Chief Legal Officer & Corporate Secretary (currently vacant), Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management, and which supports the Audit Committee's oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters. We have in place robust physical, technical, administrative, and organizational controls for the securing of our information systems.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and We had no material cybersecurity incidents in 2024.

companyName: Village Bank & Trust Financial Corp.


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at both a technical and management level.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Our Board of Directors oversees significant cybersecurity risks to the Company directly and through its Audit Committee. The Board of Directors meets with our CSO or his delegate annually to review significant cybersecurity risks as well as cybersecurity priorities and focus areas for the upcoming fiscal year. The Audit Committee meets with our CSO or his delegate quarterly to review significant cybersecurity incidents and risks, programmatic security modifications and enhancements, and progress made towards key cybersecurity initiatives and matters. The CSO may provide more frequent updates to the Board of Directors and Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to our Board of Directors regarding the committee's oversight of cybersecurity risk matters.

companyName: Dell Technologies Inc.

ticker: DELL


text: Managing Material Risks & Integrated Overall Risk Management To manage cybersecurity risk and threats, we have developed and continuously review and update our internal risk controls ("Cyber Risk Controls"), which include administrative, physical, and technical controls and which are aligned to the CIS Critical Security Controls and the National Institute of Standards and Technology Cybersecurity Framework. The Cyber Risk Controls are in many cases integrated with our other controls, policies, procedures and programs to maximize their effectiveness. Likewise, our internal cybersecurity control group meets regularly to discuss and review identified cyber threats and risks as well as to conduct cybersecurity threat scenario planning. Identified cybersecurity risks are then further analyzed by other risk management personnel as part of our enterprise risk management process.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report.

companyName: Next Bridge Hydrocarbons, Inc.


text: Our executive management, the Audit Committee, and the Board of Directors are notified of any significant cybersecurity incidents through an escalation process that is established in our incident response plan and incorporated into our disclosure controls and procedures. Additionally, we maintain a third-party vendor relationship which is available to the team for on-demand incident response and investigation, as needed.

companyName: A10 Networks, Inc.

ticker: ATEN


text: Incidents and Material Impacts The Company has not experienced any cybersecurity incidents that materially affected our business strategy, operational results, or financial condition. The Company remains vigilant in monitoring and mitigating potential cybersecurity risks to safeguard its long-term resilience and operational integrity, but there is no guarantee that any risks from cybersecurity threats will not materially affect us in the future. For additional discussion of the Company's risks from cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to the Company's Business and Structure—Cybersecurity risks and cyber incidents may adversely affect the Company's business or the business of the Company's portfolio companies by causing a disruption to the Company's operations or the operations of the Company's portfolio companies, a compromise or corruption of the Company's confidential information or the confidential information of the Company's portfolio companies and/or damage to the Company's business relationships or the business relationships of the Company's portfolio companies, all of which could negatively impact the business, financial condition and operating results of the Company or the Company's portfolio companies."

companyName: 5C Lending Partners Corp.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of Cohen & Steers' Cybersecurity Management, including its CISO, CTO and Head of IT Infrastructure.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: From an operational perspective, we use vulnerability scanning tools to assess potential data security risks. We correlate the results and prioritize any key actions based on threat modeling analysis and monitor any such actions in-progress with the system owners based on assigned timelines for remediation. However, patch and vulnerability management, including for products and information assets, remains a complex and key risk that can lead to exploits, security breaches and service disruption. In addition, our online employees are required to participate in cyber, information security, and privacy training at least annually. We also maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. Subsequent to March 31, 2024, all employees will begin receiving cybersecurity training and other education regarding their use of computers, information technology, and sensitive data, including specifically how to recognize common attack strategies. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third parties applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. Our goal is to only utilize the most secure and trusted providers for our IT needs. To this end, we are currently reviewing the security credentials and certifications of our key application providers. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Our information security program includes development, implementation, and improvement of policies and procedures to safeguard information to help ensure availability of critical data and systems. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our program further includes review and assessment by external, independent third parties, who assess and report on our internal incident response preparedness and help identify areas for continued focus and improvement. With the assistance of one such reputable third party, the Company conducts biannual maturity assessments of its IT Systems against the National Institute of Standards of Technology (NIST) Cybersecurity Framework. We also carry insurance that provides protection against the risks from cybersecurity threats. To our knowledge, during 2024, there were no material cybersecurity incidents or threats that materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: Dorman Products, Inc.

ticker: DORM


text: As part of our cybersecurity risk management program, we also conduct cybersecurity and privacy assessments on all third parties who integrate with Stryker's data, network, systems and products. We use a combination of internal and external tools to confirm that these third parties meet our security requirements. We leverage standard industry threat model and privacy impact assessment concepts to confirm that data minimization and adequate data protections are in place. We perform supplemental reviews as necessary, commensurate with the risk associated with each vendor.

companyName: STRYKER CORP

ticker: SYK


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, anti-malware software, and monitoring software agents that are installed on our devices.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: Our products, services and systems are accessed through critical company or third-party operations. These operations involve the storage, processing and transmission of sensitive data, including proprietary or confidential data, regulated data, and personal information of employees and customers. Successful breaches, employee wrongdoing, or human or technological error could result in unauthorized access, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems. Examples of a breach include theft of sensitive, regulated, or confidential data, including personal information; loss of access to critical data or systems through ransomware, destructive attacks, or other means; and business delays, service or system disruptions, or denials of service.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Oversight of Third-party Risk We also maintain a third party risk management program that applies to all third-party vendor relationships. Our Board of Directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to regarding strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews this policy on at least an annual basis to assure that we implement procedures and practices have been established by management. Our chief risk officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company's strategic goals, risk appetite and the level of risk and complexity of its third-party relationships. This individual regularly reports to the Board of Directors regarding third-party risk management activities. The Company's internal audit staff also determines the frequency and scope of audits to examine the effectiveness of our third party risk management program.

companyName: OP Bancorp

ticker: OPBK


text: Impact of Cybersecurity Threats Our results of operations and financial condition have not been materially affected by cybersecurity threats or incidents to date. However, to assess, identify, and manage material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have invested and expect to continue to invest significant resources to maintain and enhance our information security and controls or to investigate and mitigate security vulnerabilities. As a result, cybersecurity threats and other technological risks involving our systems have materially affected our business strategy and processes. Although we believe that we maintain a robust program of information security and controls and that none of the cybersecurity incidents that we have encountered to date have materially affected us, we cannot be certain that the security measures and procedures we have in place to detect security incidents and protect sensitive data will be successful or sufficient to counter all current and emerging risks and threats. The impact of a material cybersecurity incident involving our systems and data, or those of our clients, partners or vendors, could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: FISERV INC

ticker: FISV


text: The Audit Committee meets on a quarterly basis. A set agenda of risk matters includes detailed updates of the Company's preparedness and significant cybersecurity activities. The topics covered by these updates have included discussions of policies and procedures to prevent, detect and respond to cybersecurity incidents, modifications to on-line platforms, and the use of cloud-based applications. Lessons learned from cybersecurity incidents and the internal and external testing of our cyber defenses are provided quarterly. The Board is also provided with an annual cybersecurity technology risk and control update.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: We have processes in place designed to identify and mitigate risks from third-party vendors, including, as appropriate, pre-contractual security assessments and review of contractual terms addressing cybersecurity and data protection.

companyName: Sonos Inc

ticker: SONO


text: The Company recognizes the risks posed by cybersecurity threats, including the risk of harm to our customers, our financial condition and results of operations, and our reputation. Following a layered defense-in-depth strategy, the Company utilizes a variety of controls and both internal and third-party resources to assess and manage identified risks. The following components of our information security program address cybersecurity risk management, and have been integrated into the Company's overall risk management systems and processes:

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: NextPlat uses, stores, and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems, and our business operations.

companyName: NextPlat Corp

ticker: NXPL


text: We engage assessors, consultants, auditors, and other third parties in order to obtain external validation for effectiveness and adequacy of our security posture in compliance with regulatory requirements. These service providers attest to our organization-wide design and implementation of cybersecurity policies and procedures, and annually monitor such policies and procedures from a safety perspective.

companyName: QUALYS, INC.

ticker: QLYS


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: We employed email correspondence anti-leakage software and firewall system to our website. In 2023, we did not identify any cybersecurity events that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Smart Powerr Corp.

ticker: CREG


text: Our incident response plan is designed to address security incidents promptly and effectively, supported by stringent information security policies and the implementation of a Security Information and Event Manager (SIEM) system for real-time analysis and reporting of security events and incidents. Furthermore, identity management and mobile device management extend our security perimeter, safeguarding against both external and internal threats. As part of our annual security commitment, we undergo annual penetration testing to assess whether our necessary security controls are maintained.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: We aim to incorporate industry best practices for companies of our size and financial strength throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and training programs to assess, identify, and manage material cybersecurity risks. Our Board of Directors has ultimate oversight of cybersecurity risk and has established a Cybersecurity committee headed by our Chief Financial Officer. As a small organization with limited resources, we do not have a dedicated cybersecurity organization or employee personnel with specific cybersecurity expertise. Our Chief Financial Officer was chosen to head our Cybersecurity committee due to more generalized management experience with financial and operating systems and oversight of third-party providers. Our Management team and our Board of Directors regularly review our cybersecurity program which generally occurs at least annually, or more frequently as determined to be necessary or advisable.

companyName: Monopar Therapeutics

ticker: MNPR


text: Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.

companyName: ChampionX Corp


text: To date, there have been no significant risks from cybersecurity threats, including as a result of any significant cybersecurity breaches or attacks that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."

companyName: PBF Energy Inc.

ticker: PBF


text: The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape, which are designed with the goal of implementing and maintaining a robust cybersecurity program. Where appropriate, the Company takes additional and ongoing steps intended to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors and various regulators. For example, each year, the Company conducts various third-party audits, including SOC 2 Type2, PCI DSS, ISO 27001. The Company also engages third-party consultants for incident responses. These third-party consultants report directly to the Chief Information Security Officer and, depending on the nature of the incident, report directly to the Executive Security Steering Committee on various topics including, effects of the incident and recommendations on how to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. In addition to assessing the Company's cybersecurity preparedness, the Company also considers and evaluates cybersecurity risks associated with its use of third-party service providers. The Company maintains a vendor onboarding program, pursuant to which the Company regularly reviews third-party hosted applications and, when available, requests its vendors to provide SOC2 and/or ISO 27001 certificates. The Company's assessment of risks associated with use of third-party providers is part of the Company's overall cybersecurity risk management program.

companyName: DraftKings Inc.

ticker: DKNG


text: The Board of Directors oversees the risks associated with cybersecurity and the physical security of our assets, with information security matters being discussed at board meetings as well as at the ONES and Audit Committee meetings throughout the year.

companyName: XCEL ENERGY INC

ticker: XEL


text: Central to our enterprise risk management efforts, QHSLab, Inc. has developed a comprehensive incident response plan to swiftly and effectively address cybersecurity incidents. This plan is a cornerstone of our commitment to maintaining the highest levels of data security and patient privacy.

companyName: QHSLab, Inc.

ticker: USAQ


text: The Company uses employee training and education as part of the comprehensive system designed to protect the Company's information systems. Through mandatory training and ongoing awareness campaigns, including phishing simulations, we are educating our personnel about cybersecurity risks and providing them with the tools to identify, prevent and report potential cybersecurity threats.

companyName: MANITOWOC CO INC

ticker: MTW


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect our ability to pay dividends to our stockholders".

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our IT Director, who reports to our Chief Financial Officer and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our IT Director leads our information technology team and regularly reports to our Audit Committee.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: The Company's Vice President of Information Security has served in various roles in information technology and information security for over 25 years, including serving as Vice President of Information Security and Product Security Officer for large public companies. In addition, the Company's Vice President of Information Security has previously held roles including Security Risk Assessor, Security Policy Development, and Security Architect. The Company's Vice President of Information Security has also contributed to the development and review of various security-related publications including the National Institute of Standards and Technology, the International Organization for Standardization, and the Cloud Security Alliance, has served in numerous roles on various cybersecurity-related advisory boards, and holds a B.S. in Electrical Engineering from Fairleigh Dickinson University.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Our Management and the Board of Directors provide significant oversight of cybersecurity risks. In May 2022, the Board expanded the Audit Committee's charter to include cybersecurity and information technology readiness. In addition, the Audit Committee was renamed to the "Audit and Risk Committee" to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology. Further enhancing our cybersecurity governance, in 2024, the Cybersecurity Subcommittee of the Audit and Risk Committee was formally established. This subcommittee generally meets on a quarterly basis and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity matters.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Employee Training: The Company provides associates with cybersecurity training and awareness programs. These initiatives are intended to help employees recognize and respond appropriately to potential threats like phishing attempts, or social engineering and account takeover. This includes conducting tabletop exercises, fostering preparedness and effective response within the Company.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Processes of Addressing Cybersecurity Threats Cybersecurity is critical to our business. As an energy infrastructure company, we face a variety of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target critical infrastructure sectors. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. The process is supported by management and overseen by our board of directors.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Risk Identification and Assessment We have adopted processes and procedures, including those described below to identify cybersecurity risks and events. Our CISO maintains a cybersecurity risk assessment program that includes, for each identified material risk, an evaluation of the applicable threat level for such risk and the current mitigation plan for such risk. The cybersecurity risk assessment receives input from cross-functional teams across our organization. We also engage various third parties (including penetration testers, auditing firms and managed security service providers) to assist in identifying and assessing material cybersecurity risks.

companyName: Repay Holdings Corp

ticker: RPAY


text: Our Information Systems department, in addition to managing our general information technology systems, is also responsible for managing our enterprise-wide cybersecurity processes. Personnel in our Information System department collectively have decades of experience in information security, information technology and cybersecurity operations. Our Information Systems department monitors, and receives notifications of, potential cybersecurity incidents detected through automated detection and monitoring tools. In the event we discover a material cybersecurity incident, Information Systems personnel reports such incident to our Chief Financial Officer, who then reports to our Chief Executive Officer and the Audit Committee, as appropriate. We do not currently have a Chief Information Security Officer or other senior security officer of a similar title.

companyName: Cronos Group Inc.

ticker: CRON


text: As our business objectives and operational needs change, our cybersecurity professionals continuously evaluate and refine the measures taken to address our identified risks for each subsidiary. Our technical measures, based on each subsidiary's environment, may include firewalls, segmented networks, intrusion detection and prevention systems, encryption, anti-malware tools, and configuration controls, to shield our information systems from cybersecurity incidents. Additionally, we apply strong access controls, enforce multi-factor authentication, and regularly update software and patches against vulnerability exploitation.

companyName: ARGAN INC

ticker: AGX


text: Use of Consultants and Advisors NTIC engages various third-party cybersecurity service providers to assess and enhance its cybersecurity practices and assist with protection and monitoring of its systems and information, including with respect to protection of its e-mail, system access, network monitoring, endpoint protection, vulnerability assessments, and penetration testing. NTIC engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices, such as a third party consulting firm to perform tabletop exercises and evaluate NTIC's cyber processes, including an assessment of its incident response procedures.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Management is responsible for day-to-day risk management activities, including those relating to information systems and cybersecurity. We employ an internal chief information security officer ("CISO") who has more than 25 years of technology industry leadership, cybersecurity expertise, and engineering and operations experience. Our CISO and his team of certified security subject matter experts (collectively, "Information Security") have deep experience and expertise in cybersecurity and lead our organizational efforts to assess and manage material risks associated with our information systems and cybersecurity threats. Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and key performance indicators. On a quarterly basis, Information Security also meets with business segment leadership to discuss the most significant risks, including identifying potentially material risks and developing, implementing, and applying reasonable risk mitigation processes.

companyName: CLARIVATE PLC

ticker: CLVT


text: In support of our risk management framework, we maintain a vendor management policy and program to manage third-party risk. Embedded in our vendor management policy is a defined process to assess the risks related to new vendors. Vendors deemed to be high risk are re-assessed annually. These assessments include security questionnaires and reviews of Service Organization Controls (SOC) Reports, where applicable. Cboe uses a third-party service to help monitor the security posture of our vendors that process and/or store confidential Cboe information.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: We engage consultants and third parties in connection with our risk assessment processes. These providers assist us in evaluating our cybersecurity program, provide support for threat monitoring and detection, and scan for vulnerabilities and other related security events which may pose a risk to the company.

companyName: AppLovin Corp

ticker: APP


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage the risk assessment and mitigation process.

companyName: GrowGeneration Corp.

ticker: GRWG


text: Our risk management team collaborates with our Chief Information Officer ("CIO"), our internal information technology ("IT") department, our Compliance team and our third-party IT managed service providers to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents. Our CIO and IT Department implement processes around security monitoring and vulnerability testing. We also have in place an incident response process for responding to and escalating cybersecurity events and incidents.

companyName: Verastem, Inc.

ticker: VSTM


text: Our board of directors, with assistance from management, monitors and assesses strategic risk exposure, and our management team is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit and Risk Committee of our board of directors ("Audit and Risk Committee").

companyName: QUALYS, INC.

ticker: QLYS


text: Our cybersecurity program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality and integrity of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standard.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: While we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.

companyName: Fluent, Inc.

ticker: FLNT


text: At each quarterly board meeting, the full board receives the quarterly cybersecurity board update that is prepared by our CISO. The report provides a comprehensive cybersecurity update for the past quarter, usually including topics such as details on threat landscape, incident response, security metrics and performance, compliance and regulatory updates, cybersecurity investments and budget, employee security awareness and trainings, vendor risk management updates, business continuity and disaster recovery updates, and an update on cybersecurity strategy, projects and roadmap.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Our Information Security Program is led by our Director of Global Information Technology, who has over 20 years of relevant educational and technical experience. The Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. We have integrated cybersecurity risk into our disclosure controls and procedures. The Audit Committee of the Board of Directors regularly reviews and discusses with management risks related to our information systems, information security, data privacy and cybersecurity risks and the Company's risk assessment and risk management programs and the steps management has taken to monitor and control such exposures. The Audit Committee also receives, at least quarterly, updates from the Director of Global Information Technology and senior management regarding material information regarding the Company's information systems, information security, data privacy and cybersecurity.

companyName: Eagle Bulk Shipping Inc.


text: Our Information Security Program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for all critical functions; • a physical security program that is tested regularly; • obtaining and maintaining appropriate insurance and indemnification for cybersecurity incidents; including insurance to cover cybersecurity incidents affecting third party vendors and service providers: and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties.

companyName: First Internet Bancorp

ticker: INBK


text: The Audit Committee receives reports as necessary, and no less than quarterly, from our cybersecurity management team on our cybersecurity risks and related information, including, but not limited to, analysis of events that have impacted our peers, updates on program maturity, regulatory compliance status and cybersecurity program status and updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: We are committed to maintaining robust governance, oversight and management of cybersecurity risks. We have established and implemented processes, supported by written policies and procedures, to detect, assess, classify, respond to, report, track, and resolve cybersecurity threats or incidents. We have implemented systems and controls to address the information technology risks to our organization, our business partners and our customers. We employ a layered security approach leveraging diverse strategies including data loss prevention, access and identity management, network security, vulnerability management, end-point security and information security education and awareness, among others. As a federally regulated institution, the Company strongly supports an environment that facilitates and abides by the Confidentiality, Integrity, and Availability security principles.

companyName: BankUnited, Inc.

ticker: BKU


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify the Company should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes are also being enhanced to ensure that vendors' cybersecurity controls are evaluated.

companyName: Third Harmonic Bio, Inc.


text: We do not maintain insurance policies to mitigate cybersecurity risks because such insurance may not be available or may be more expensive than the perceived benefit. Further, any insurance that we may purchase to mitigate certain risks may not cover all losses.

companyName: Freedom Holding Corp.

ticker: FRHC


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third parties associated with our clinical trial development, such as contract research organizations and contract manufacturing organizations.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats, including technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy include the following:

companyName: CELESTICA INC

ticker: CLS


text: Enterprise Risk Management Process Integration Cybersecurity risk management processes are an integral part of our enterprise risk management, which is overseen by the Audit Committee of the Board. Our processes include periodic program maturity assessments, ongoing information technology risk assessments, and third-party security risks assessments.

companyName: Baker Hughes Co

ticker: BKR


text: To keep the ISSG and Credit and Risk Committee informed, management ensures consistent and structured reporting mechanisms are in place. They regularly update these governing bodies on the prevention, detection and mitigation of cybersecurity incidents. This reporting includes detailed insights into the institution's cybersecurity posture, ongoing initiatives and any necessary adjustments or enhancements to existing measures.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Company has implemented several measures to protect against cybersecurity threats, while recognizing the importance of continuing to strengthen its overall security framework. Threat Detection & Response: Active monitoring for account takeover attempts and identity-based threats. Detection & Response: Continuous monitoring, detection, and response to potential endpoint threats. Authentication: Enforced across Office 365 accounts, which comprise the majority of the Company's infrastructure. Device Security: Company devices are centrally managed for patching, antivirus, monitoring, and security enforcement. Scanning & Remediation: Regular scanning of systems to identify potential weaknesses, with remediation measures applied to reduce risk.

companyName: Genvor Inc

ticker: GNVR


text: We extend our cybersecurity diligence to third-party service providers and require periodic employee training. All external partners are required to adhere to our cybersecurity standards, and our employees receive ongoing training to stay current with emerging threats and best practices. This comprehensive, layered approach not only safeguards critical data but also reinforces our commitment to continuous improvement and compliance with statutory and regulatory requirements.

companyName: MINISTRY PARTNERS INVESTMENT COMPANY, LLC


text: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our cybersecurity and data privacy strategy, policies, and procedures and consists of experts in the execution of the related controls and safeguards. Our CIO has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors. While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs. Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework and data privacy procedures, as well as implements cybersecurity control systems and solutions. This cybersecurity team collectively has experience in: cybersecurity, information systems management and security, and related fields of focus.

companyName: Meritage Homes CORP

ticker: MTH


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning and incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.

companyName: OSHKOSH CORP

ticker: OSK


text: Despite the security measures implemented as part of our Program, the current cyber threat environment presents increased risks for all companies, and we are a frequent target of cyber-attacks and have experienced security incidents. For example, on January 18, 2023, the Company announced a ransomware attack that impacted certain Information Technology ("IT") systems. This incident resulted in the closure of fewer than 300 restaurants in one market for one day, and certain of the Company's IT systems and data were affected. In addition, although data was taken from our network, the affected data was limited to certain personal information of former and current employees, and we have no evidence that customer databases were accessed.

companyName: YUM BRANDS INC

ticker: YUM


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Recognizing the inherent cybersecurity risks common to any organization, encompassing concerns such as unauthorized access to sensitive data, potential disruptions to business operations from cyber incidents, and the associated financial and reputational impacts arising from a cybersecurity breach, we have implemented comprehensive policies covering various aspects of cybersecurity and information management, including, without limitation, cyber risk management, information security practices, roles and responsibilities, access controls, cryptography, information classification, asset disposal, and vendor management. We periodically review and modify these policies to align with industry practice, trends and evolving threat landscapes. Compliance with these policies is expected from all employees and contractors.

companyName: INNODATA INC

ticker: INOD


text: Our management team, including the Chief Technology Officer and Chief Information Security Officer, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of cybersecurity experience, including past roles as a Chief Information Security officer and with a leading accounting and professional services firm. Our current Chief Information Security Officer has 20 years of relevant information technology and cybersecurity experience.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: The Markel information security and data protection program is led by a Chief Information Security Officer (CISO) who supervises a team of security and data protection professionals across the globe. Markel's global information security and data protection program leverages the Cybersecurity Framework from the National Institutes of Standards and Technology as well as industry best practices. Markel also is able to map to both ISO (International Organization for Standardization) and BSI (British Standards Institution) among other cybersecurity standards. Markel's CISO has been with Markel 13 years and has 22 years' experience in information technology, with 17 years in information technology security, and is a certified Information Systems Security Professional (CISSP).

companyName: MARKEL GROUP INC.

ticker: MKL


text: Audit Committee Oversight Our Audit Committee oversees the Company's cybersecurity risks. Ms. Dvorak has a certificate in Cybersecurity Oversight from the National Association of Corporate Directors and Mr. Burton is a technology expert with experience in online fraud and cybersecurity. Both Ms. Dvorak and Mr. Burton are members of our Audit Committee.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Cybersecurity risk oversight continues to remain a top priority for our Board. The audit committee of our Board maintains primary responsibility related to overseeing our cybersecurity risk as part of its program of regular risk management oversight. This includes, but is not limited to, the overall maturity and strategy of our cybersecurity program.

companyName: MediXall Group, Inc.

ticker: MDXL


text: As necessary and appropriate, we engage consultants, or other third parties, in connection with our cybersecurity risk assessment processes. These service providers assist us in designing and implementing cybersecurity procedures, as well as in monitoring and testing the effectiveness of our cybersecurity safeguards. For example, we engage these vendors to conduct annual risk assessments, including internal and external penetration testing, to identify cybersecurity threats, as well as to perform cybersecurity risk assessments in the event of substantial changes to our business practices that may affect our information systems. These cybersecurity risk assessments are designed to include identification of reasonably foreseeable internal and external cybersecurity risks, analysis on the likelihood and potential damage that could result from such risks, and feedback on the sufficiency of our existing procedures, systems, and safeguards to mitigate such cybersecurity risks.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: As part of the risk program, third parties engaged by the Company are subject to initial and continuous security monitoring activities including the use of Security Information Event Monitoring ("SIEM") software and regularly scheduled vulnerability assessments performed by an independent third-party to capture and identify vulnerabilities, security events, and potential incidents. The Company also maintains a formal information security training program that includes training on matters such as phishing and email security best practices as well as data privacy which is required for all employees on an annual basis.

companyName: ModivCare Inc

ticker: MODVQ


text: For a description of the risks from cybersecurity threats that may materially affect our company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled "If our security measures, or those maintained on our behalf, are compromised, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, products, communications or data is compromised, limited, or fails, our business could experience a material adverse impact, including without limitation, a material interruption to our operations, harm to our reputation, a loss of customers, significant fines, penalties and liabilities, or breach or triggering of data protection laws, privacy policies or other obligations."

companyName: Everpure, Inc.

ticker: PSTG


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Senior Vice President – Information Systems and Technology, who reports to our Chief Financial Officer. The IT Department's security team, a cross-functional group composed of members who all have 12 to 26 years of professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation and remediation of cybersecurity incidents and also for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: At the management level, our Corporate Crisis Management Team (CCMT) is comprised of senior representatives from all key business functions, including finance, operations, and legal, and has broad oversight of our risk management processes. The CCMT has global responsibility for corporate crisis management, policy guidance, and training for employees involved in crisis management at all levels. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A—Risk Factors, which should be read in conjunction with this Item 1C—Cybersecurity.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We maintain robust and comprehensive processes, procedures and controls to protect and secure our information systems and data infrastructure from cybersecurity threats. Our cybersecurity program is led by our Vice President of Technology, who functions as our chief information security officer (" CISO "). Our CISO has over 20 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies. Our cybersecurity program interfaces with other functional areas within the Company, including but not limited to our business segments and information technology (" IT ") and legal departments, as well as external third-party partners, to identify and understand potential cybersecurity threats, including those associated with any third-party service providers we may use. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments. We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the International Organization for Standardization (" ISO ").

companyName: Reservoir Media, Inc.

ticker: RSVR


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has 15 years of information technology and security-based experience, and holds certifications relevant to cybersecurity, including CMMC CCP (Certified Cybersecurity Maturity Model Certification Professional) and CISSP (Certified Information Systems Security Professional). During the first quarter of 2025, the Company hired an Information Security Manager who is a CISSP-certified cybersecurity professional with over 20 years of experience in information technology, security engineering, and risk management. The Information Security Manager has also been added to the Information Security Committee mentioned above.

companyName: LINKBANCORP, Inc.

ticker: LNKB