text: Our IT Security Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer. Our Chief Financial Officer leads the Company's Incident Response Team to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our IT Security Incident Response Plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Longboard Pharmaceuticals, Inc.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital security programs and risks lie with the Audit Committee of the Board. The Board is actively engaged in the oversight of our cybersecurity and digital security programs and oversees all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, data security, and technology.

companyName: Baker Hughes Co

ticker: BKR

secItem: Item 1C


text: Cybersecurity risk management strategy is an integral component of our operations and our overall risk management process. Recognizing the dynamic nature of cybersecurity threats, we have implemented a comprehensive risk management program that aims to identify, assess, and mitigate potential risks. Our strategy involves a proactive approach, incorporating preventative measures, continuous monitoring, and adaptive response mechanisms. We prioritize the safeguarding of our operational network environment, sensitive data, including confidential business information and personal details of our customers and employees. Regular assessments conducted both internally and by third parties ensure our cybersecurity program aligns with industry standards. In addition to a dedicated cybersecurity team, we employ a defense-in-depth strategy, utilizing multiple security measures to protect our information technology system. Collaboration with third-party experts, industry peers and ongoing training initiatives ensures our cybersecurity strategy remains robust and responsive to evolving threats. We understand the importance of maintaining a vigilant and adaptive stance in the ever-evolving landscape of cybersecurity to safeguard our business operations, financial stability, and as a direct result, our overall success. A dedicated cybersecurity team; Collaboration with a third-party managed detection and response company for 24/7 monitoring and response; Cybersecurity insurance to cover a portion of losses and damages resulting from cyber-attacks or security breaches; An incident response team that is comprised of various departments required for an effective response; Conducting periodic drills and exercises, including industry collaborations and participation from the executive team; Continuous information security awareness training and phishing simulation exercises; Regular security assessments to address evolving risks and threats;

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: We regularly engage external parties, including consultants, auditors, and cybersecurity service providers to enhance our cybersecurity oversight. For example, we maintain an ISO 27001 certification for our BrightTALK platform and obtained a SOC 2, Type II report for our Priority Engine platform. These third-party assessments are evaluated and updated regularly. Additionally, we utilize various external parties and tools to assist us with annual penetration testing, cybersecurity and related training, vulnerability and patch management, threat detection and response, and information technology general controls.

companyName: TechTarget Holdings Inc.


text: The Company provides security awareness training for all employees on a regular basis. The training is designed to educate and prepare employees to recognize unsafe practices and to properly respond to phishing attacks from email, social media, and other sources. Follow-up testing using simulated attack tools is used to validate the effectiveness of training and compliance.

companyName: GRAY MEDIA, INC

ticker: GTN


text: As part of its overall risk management system, the Company utilizes a third party to assess the Company's processes and practices for managing and mitigating cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on assessment of their criticality to our operation and respective risk profile, suppliers, and vendors that have access to our critical systems and information.

companyName: NEVRO CORP


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and has established robust processes to oversee such risks.

companyName: ZimVie Inc.


text: The Company's current CTO has over 20 years of experience in senior technology leadership roles, involving oversight of all aspects of technology development and technical operations, including cybersecurity.

companyName: IMAX CORP

ticker: IMAX


text: Our Cybersecurity Approach and Integration Technology is a fundamental element in our Company's permanent engagement with innovation and continuous improvement in the area of risk management and cybersecurity management strategy. As cybersecurity threats are becoming increasingly sophisticated and rapidly evolving, we have implemented processes for overseeing and identifying material risks from potential cybersecurity threats. Cyber risk management is a core component of our Company's governance structure, and our cybersecurity processes are integrated into the Company's overall risk management system and processes. Our primary focus is information security.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees with network access are required to complete annual security awareness training and quarterly spear phishing exercises.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing certain reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating certain threats reported to us, conducting third-party threat assessments, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Review of these processes has been incorporated into our annual risk assessment and internal audits of controls performed by our Internal Audit department. Results of these audits are reported to the Audit Committee by our Vice President of Internal Audit and Corporate Governance.

companyName: NVR INC

ticker: NVR


text: As part of the Company's overall risk management strategy, the Company has instituted a cybersecurity risk management program and a set of procedures to protect, identify, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. A variety of security tools are utilized to prevent, identify, investigate, address, and recover from identified vulnerabilities and security incidents. We employ security technologies, including firewalls, encryption, intrusion detection systems, and multi-factor authentication. In addition, we purchase cybersecurity insurance through a reputable carrier, which includes access to a breach coach and a preferred panel of experienced, qualified vendors to respond to an actual attack.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: The Company's management, including members of its IT and Compliance Committees, also assess and manage material risks, if any, from cybersecurity threats with the assistance of our third-party IT and cybersecurity vendors.

companyName: ALIMERA SCIENCES INC


text: As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Item 1A. "Risk Factors—Operational Risks— Increased information technology security threats and more sophisticated computer crime pose a risk to our systems, networks, products and services" of this Form 10-K, these threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of our data. Cybersecurity attacks could also include attacks targeting customer data or the security, integrity and/or reliability of the hardware and software installed in our products. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-party service providers to implement, will be sufficient to protect and mitigate associated risks to our systems, information or other property.

companyName: CATERPILLAR INC

ticker: CAT


text: As of the date of this report, Infinera has not experienced any cybersecurity incidents it has determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to the section titled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Infinera Corp


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises, to inform our cybersecurity risk identification and assessment. We use third-party service providers to perform a variety of functions throughout our business, such as professional services firms and cybersecurity software providers. Depending on the nature of the services provided and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate certain cybersecurity incidents, as well as to comply with applicable reporting obligations.

companyName: AIR LEASE CORP

ticker: AL


text: Employee awareness of cybersecurity risks and threats is also an important part of an effective control environment. We periodically communicate to employees about this cybersecurity awareness. In 2024, we plan to require each of our employees to complete annual information security training, in addition to other training requirements. This should lead to an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Management Oversight Our cybersecurity program was managed on a day-to-day basis by our IT department, which was led by our SVP - Information Technology, who has a Master of Business Administration degree and a Master Certification in Cybersecurity from Colorado State University along with more than 25 years of experience. Our IT department's experience included network and system security, backup and recovery strategies and software design and implementation. Areas of substantial experience also included IT audits and anti-phishing training, as well as server installation, configuration and administration.

companyName: EQC Liquidating Trust


text: Our full Board oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Risks from cybersecurity threats have, to date, not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition; however, from time to time, we have experienced threats and security incidents relating to our and our third party vendors' information systems. For additional information, please see the section captioned "Part I. Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: CoreSite's steering committee includes CoreSite's Chief Executive Officer, its Chief Accounting Officer, its Chief Revenue Officer, its Senior Vice President of IT & Digitization, its Vice President of Legal, its Senior Vice President of Development & Product Engineering, its Senior Vice President of Data Center Operations, its Senior Vice President of Human Resources, its Vice President of Compliance & Internal Controls, its Senior Vice President of Finance & Corporate Development, its Vice President of Information Security and IT Infrastructure, its Director of Compliance & Internal Controls, and American Tower's CISO. Each of CoreSite's steering committee members has been chosen based on their understanding of, and participation in, maintaining the rigorous control environment necessary to achieve the list of certifications detailed below.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We devote significant resources to protecting and improving the security of our systems and employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises, to inform our professionals' risk identification and assessment.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: To date, the Company is not aware that its business or operations have been materially impacted by these cyberattacks. However, the Company's security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company's, or its third-party service providers', databases or systems.

companyName: ENTEGRIS INC

ticker: ENTG


text: Notwithstanding the breadth of the Company's information security program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, see Item 1A. "Risk Factors," which is incorporated by reference into this Item 1C.

companyName: FOOT LOCKER, INC.


text: We have not currently identified any cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Form 10-K.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our board when found. In addition, our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: The third-party security operations center, the endpoint managed detection and response service, and third-party penetration testing vendors are overseen by the CISO.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: ProPhase Labs, Inc.

ticker: PRPH


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. Our business depends on the availability, reliability and security of our and our third-party contractors' information systems, networks and data.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: California Resources Corp

ticker: CRC


text: We have not identified any cybersecurity incidents that individually, or in the aggregate, have materially affected or are reasonably likely to materially affect the Company. Regardless, we recognize cybersecurity threats are ongoing and evolving, and there can be no guarantee that we will not be subject to a cybersecurity incident that has a material effect on our business.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: We also have a Corporate Information Security Steering Committee ("CISSC"), which includes several members of senior management, including the Chief Financial Officer ("CFO") and General Counsel. The CISSC oversees corporate information security initiatives and the Company's responses to cybersecurity incidents, and reports to the board of directors on certain of the Company's corporate security programs and investments.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Our information security program also includes a cybersecurity Incident Response Plan ("IRP") that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements. The IRP specifies the process for identifying and reporting an incident, initial investigation, risk classification, documentation and communication of incidents, responder procedures, incident reporting, and ongoing training. The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders. The Company also maintains dedicated cyber liability insurance for breach event costs including: post breach event remediation costs;

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: The Company's CRO has over 27 years of experience in cybersecurity and information technology. The CRO joined the Company in 2011 and became CRO in July 2023. Prior to becoming CRO, he served as SVP and Director of Information Security & ERM for six years and prior to that served five years as Vice President and Senior Information Security Officer of the Company. Prior to joining the Company, the CRO had a ten year career in information technology and began his career serving with the U.S. Air Force, specializing in information technology, cybersecurity, risk mitigation, and encrypted communications.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: We have not adopted any specific cybersecurity risk management program or formal processes for managing risks from cybersecurity threats. However, in our overall risk management processes, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations and assets. These include, but are not limited to, engaging a third-party information technology consultant who maintains and monitors our information technology network, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: GigCapital7 Corp.

ticker: GIG


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are evaluated. However, despite these efforts, we cannot eliminate all cybersecurity risks or provide assurance that we have not had occurrences of undetected cybersecurity incidents. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: As part of the above planned processes, we may engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Bimergen Energy Corp

ticker: BESS


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business strategy, results of operations or financial condition. Notwithstanding the defensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats, incidents or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see Part I, Item 1A., "Risk Factors— Risks Related to the Company's Operations—A failure in the Company's operation and/or information systems or infrastructure, or those of third parties, including cyber-attacks, could impair the Company's liquidity, disrupt its businesses, result in the unauthorized disclosure of confidential information, damage its reputation, and cause financial losses."

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We regularly evaluate our overall security risk posture to ensure appropriate security controls are in place to ensure confidentiality, integrity, and availability of the firms processing environment, including our business strategy, results of operations or financial condition, to ensure that we have an appropriate security program in place in order to manage materiality. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information, see "Item 1A. Risk Factors – Breaches of our data security could materially harm us, including our business, financial performance and reputation."

companyName: Cottonwood Communities, Inc.


text: Andres Briseno, our SVP, Head of Finance and Investor Relations and, Douglas Snyder, our Senior Vice President, General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Mr. Briseno and Mr. Snyder have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Briseno has served in a number of significant leadership roles at our company since 2016, including oversight of investor relations, business operations and corporate developments, and was appointed as SVP, Head of Finance and Investor Relations in 2023. Mr. Snyder has served in a number of significant leadership roles in various companies in the healthcare industry, and provided an oversight to legal and compliance teams with his broad legal background. Prior to joining our company, Mr. Snyder served in senior leadership and operations roles across healthcare field, including biotechnology, pharmaceuticals and the FDA. Further, our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: ANVI GLOBAL HOLDINGS, INC.

ticker: ANVI


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans.

companyName: TCW Direct Lending VII LLC


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: In conclusion, cybersecurity risks pose significant challenges to business operations and financial stability. The Company continuously monitors and evaluates its cybersecurity posture to adapt to emerging threats and safeguard customers' information and assets.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We have processes to oversee and identify material risks from cybersecurity threats associated with or use of third-party vendors. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, we undertake the activities listed below: closely monitor emerging data protection laws and implement responsive changes to our processes; conduct annual cybersecurity training for all employees and contractors who use our systems; conduct regular email phishing testing exercises for all employees to enhance awareness and responsiveness to such possible threats;

companyName: GLAUKOS Corp

ticker: GKOS


text: We actively maintain an enterprise risk management program that includes information technology and cybersecurity risk management. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to address potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR


text: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic training, including training related to data protection, cybersecurity and incident response, and prevention and compliance, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: OCULAR THERAPEUTIX, INC

ticker: OCUL


text: Our CISO also leads our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure. The CFC partners with a third party managed systems security provider ("MSSP") to augment 24x7 cyber incident monitoring.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: The Director of Enterprise Systems leads the Company's cybersecurity program. The Director of Enterprise Systems assesses and manages XPEL's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Director of Enterprise Systems manages the third-party service provider engaged to monitor the Company's cybersecurity environment and is regularly updated by the third-party service provider on the cybersecurity activities. The Director of Enterprise Systems has 22 years of experience in information technology and is supported by a team with additional relevant experience and related certifications.

companyName: XPEL, Inc.

ticker: XPEL


text: No risks from cybersecurity threats materially affected Envestnet's business strategy, results of operations or financial condition during the year that ended December 31, 2023. Moreover, such risks do not appear to be reasonably likely to affect our business strategy, results of operations or financial condition.

companyName: ENVESTNET, INC.


text: Board oversees management's implementation of our cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Board also receives periodic reports from management on our cybersecurity risks and cybersecurity risk management program.

companyName: JUPITER NEUROSCIENCES, INC.

ticker: JUNS


text: The Fund does not have its own board of directors or any board committees. The Fund relies upon the senior management oversight of the Manager reporting cybersecurity risks to the executive officers of the Fund. The Manager has a Cyber Risk Committee in place comprised of the CIO and other executive officers of the Fund that is responsible for reviewing and approving or rejecting escalated non-standard IT change requests. The CIO communicates regularly and serves as the Fund's representation to address significant information technology activities and initiatives. The CIO has more than twenty years of experience as an information technology professional and has been CIO since 2007. The CIO has periodic calls with a third-party virtual Chief Information Security Officer on review of policy and procedures best practices and cybersecurity threats.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: To date, we have not had a significant cybersecurity breach or attack that has had a material impact on our business or results of operations, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under "Item 1A. Risk Factors–Risks Related to Our Industry and Our Business–Other Risks–We are dependent on information technology. Our systems and infrastructure face certain risks, including cyber security risks and data leakage risks," cyber-attacks are continually evolving to become more sophisticated and, while we have invested in the protection of our data and information technology to reduce the risk of a cyber-attack, there can be no assurance that our efforts will be effective in preventing breakdowns or breaches in our systems.

companyName: Summit Materials, LLC


text: Our Chief Information Security Officer reporting to our Chief Information Officer as well as the Chief Financial Officer is a twenty four year industry veteran, with 10 years of business operations experience and 14 years of technology experience including six years directly in cybersecurity. The Chief Information Security Officer has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors on a regular basis. These updates contain information such as key performance indicators, National Institute of Standards and Technology ("NIST") Cybersecurity Framework status, cybersecurity road map status, and current events and issues.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: The SVP-ITS is supported by dedicated information technology and security personnel and resources, including team members that have numerous cybersecurity certifications. Collectively, these personnel and resources allow us to strategically integrate cybersecurity into our broader risk management framework and decision-making process.

companyName: INSPERITY, INC.

ticker: NSP


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process, which evaluates and assesses top risks to the enterprise on a periodic basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's risk assessment is presented to the Board of Directors. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with the use of third-party software and service providers. Such providers are subject to security risk assessments at time of onboarding, contract renewal and upon detection of an increase in risk profile. On an annual basis we review System and Organization Controls (SOC) 1 or SOC 2 reports for third-party service providers deemed significant to our environment.

companyName: AtriCure, Inc.

ticker: ATRC


text: The Company has not had any cybersecurity risks that have materially affected the Company, including its business strategy, results of operations, or financial condition. Cybersecurity risks are disclosed in Part I Item 1A. Risk Factors, incorporated herein by reference.

companyName: TREX CO INC

ticker: TREX


text: Electric utility System overview. The Utilities rely on evolving and increasingly complex operational and information systems, networks and other technologies, which are interconnected with the systems and network infrastructure owned by third parties, to support a variety of business processes and activities, including procurement and supply chain, invoicing and collection of payments, customer relationship management, human resource management, the acquisition, generation and delivery of electrical service to customers, and to process financial information and results of operations for internal reporting purposes and to comply with regulatory, financial reporting, legal and tax requirements. The Utilities use their systems and infrastructure to create, collect, store, and process sensitive information, including personal information regarding customers, employees and their dependents, retirees, and other individuals.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking, within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our cybersecurity processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implemented risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have an information security risk program structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other standards and regulations. Our program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: 2.Assessment, Measurement and Response: Management assesses identified risks to estimate such risk's potential severity and the likelihood of occurrence. Once a risk is identified and measured, management determines the appropriate response, including determining whether to accept the risk in accordance with our established risk appetite, or alternatively to implement new controls, enhance existing controls, and/or develop additional mitigation strategies to reduce the impact of the risk.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: The Ameren Companies have identified cybersecurity as an enterprise risk, which is managed through Ameren's integrated enterprise risk management program. The program is designed to continuously assess risk and evaluate the likelihood and probability of impact in order to determine the appropriate risk tolerance and risk management strategies that inform our cybersecurity policies, investments, practices, controls, and countermeasures. The program is a comprehensive, consistently applied management framework that is designed to ensure all forms of material risk and opportunity are identified, reported and managed in an effective manner overseen by the risk management steering committee. The risk management steering committee, which is composed of senior-level Ameren officers, with Ameren board of directors' oversight, oversees Ameren's enterprise risk management processes, which include the identification, assessment, mitigation, and monitoring of risks including strategic, operational, and cybersecurity risks.

companyName: AMEREN CORP

ticker: AEE


text: We expect to develop and implement a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our overall enterprise risk management program and is expected to include a cybersecurity incident response plan.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: The Audit Committee oversees compliance with cybersecurity policies with guidance from members of management, including the Vice President of Internal Audit, who informs the Audit Committee on the audit results of cybersecurity controls.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Cybersecurity Incidents We have not experienced any material cybersecurity incidents nor have we identified risks from known threats that could likely materially impact our operations or financial results.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Utilities are the operators of critical infrastructure and maintain sensitive information, and as such the industry has been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems and confidential information to disrupt operations or for monetary gain. Idaho Power, like other entities in the utility industry, is experiencing an increase in the frequency and sophistication of these attempts. For the year ended December 31, 2024, and the subsequent period to the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that any such threat or incident will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: IDACORP INC

ticker: IDA


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, advanced email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. All access to our platform is encrypted using industry-standard transport layer security technology. When customers enter sensitive information on our site, such as tax identification numbers, we encrypt the transmission of that information using secure socket layer technology. We also use the HSTS (HTTP strict transport security) to ensure visitors connect to the website over HTTPS which adds an additional layer of protection for our customers. For servers that store personally identifiable information, the data is encrypted. Moreover, our customers may elect to further secure their account credentials through two-factor authentication that requires them to authenticate with information provided by a second device. In order to make secure payments through our platform, we are Payment Card Industry Data Security Standard certified, which means we have demonstrated compliance with the Payment Card Industry security standards required for businesses that complete credit card or debit card transactions.

companyName: UPWORK, INC

ticker: UPWK


text: Our CIO joined Washington Trust as CISO in 2016 and has more than 35 years of experience in the financial, technology, auditing, and banking industries. He has expertise in technology deployment, information technology risk management and information security policies and programs. Our current CISO has served in that position since 2018 and is a 27-year employee of Washington Trust. He has extensive experience and expertise in information technology risk management and information security policies and programs. He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor. Our CTO has served in that position since 2021 and is a 12-year employee of Washington Trust. He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.

companyName: BK Technologies Corp

ticker: BKTI


text: Our company recognizes the importance of safeguarding company and customer information. Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities. The Board of Directors is responsible for reviewing and approving the ICSPP and ICSIRP at least annually and monitoring material risks facing our company. The Board recently added a member who possesses specialized expertise in cybersecurity matters. Director Sara A. Schmidt currently serves as chief information security officer for US Foods and executive sponsor of the West Michigan Cyber Security Consortium.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event..

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.

companyName: First American Financial Corp

ticker: FAF


text: While we take cybersecurity seriously, we mitigate the common cybersecurity risks that many companies face by greatly limiting the accessibility of and our reliance on our cyber profile and web-based activities. Of our nine employees (six full-time, three part-time), a total of three employees plus one third-party information-technology consultant (our "IT Consultant") that we contract with have access to our cyber system. No vendors or customers have access to our system, which greatly minimizes the risk of unauthorized access. No part of our business entails third-party members of the public accessing our accounts, making purchases, or ordering products or services, which greatly reduces our risks of cyber-attack and minimizes the potential consequences if such an attack were to occur. In addition, although we do have a website, it is maintained offsite and is not connected to our file server, which is maintained separately in our office rather than being connected to the Internet or linked to any third-party cloud storage system.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip Fortinet personnel with effective tools to address cybersecurity threats and to communicate Fortinet's evolving information security policies, standards, processes and practices.

companyName: Fortinet, Inc.

ticker: FTNT


text: Additionally, we have procedures set forth in the DSCP for reporting and responding to potential security incidents as well as determining applicable disclosure requirements, including timely incident reporting. For example, as disclosed in our Form 8-K filed on June 22, 2023, we were notified by PBI, a third-party vendor, that PBI was subject to the widely reported security events involving the MOVEit file transfer system, which PBI uses in the performance of its services. The MOVEit Cybersecurity Incident resulted in the unauthorized acquisition of data by a third party from PBI as well as several organizations and governmental agencies. After being notified of the security event, we, together with PBI, promptly launched an investigation to determine whether and to what extent personal information had been unlawfully accessed. Approximately 2.5 to 2.7 million of our policyholders' or other customers' personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the MOVEit Cybersecurity Incident. We believe that the MOVEit Cybersecurity Incident has not had any impact on any of our information systems, including our financial systems, and that there has not been any material interruption of our business operations. While we are continuing to measure the impact, including certain remediation expenses and other potential liabilities, we do not currently believe this incident or other known risks from cybersecurity threats are reasonably likely to have a material adverse effect on our business, results of operations or financial condition. See "Item 1A—Risk Factors—Our computer systems and those of our third-party service providers have in the past and may in the future fail or be compromised, including through cybersecurity breaches; we may experience issues from new and complex information technology methodologies such as artificial intelligence; and unanticipated problems could materially adversely impact our disaster recovery systems and business continuity plans, any of which could damage our reputation, impair our ability to conduct business effectively, result in enforcement action or litigation, and materially adversely affect our business, financial condition and results of operations."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: To enhance oversight and governance in this area, 8x8's Board of Directors has established the Technology & Cybersecurity Committee. This committee focuses specifically on the Company's technology, products, and cybersecurity program, providing strategic guidance and oversight to ensure alignment with business objectives and industry standard practices.

companyName: 8X8 INC /DE/

ticker: EGHT


text: As of the date of this Annual Report, we have not identified a material cyber incident that would have a material impact on our business, results of operations, or financial condition; however, the occurrence or scope of such events is not always immediately apparent and there can be no assurance that we will not suffer a material cyber incident in the future. Refer to Item 1A "Risk Factors" of this Annual Report for further discussion on cybersecurity risks.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our CIO, who has more than 25 years of experience in technology and information security risk management across a number of organizations, is responsible for overseeing the risks related to cybersecurity. He is responsible for cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the senior leadership with regular updates on cybersecurity-related matters.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.

companyName: RetinalGenix Technologies Inc.

ticker: RTGN


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GrowGeneration Corp.

ticker: GRWG


text: The Audit Committee, pursuant to its charter, has oversight over management of cybersecurity risks. Senior management and our IT Director provide the Audit Committee with periodic updates on data management and cybersecurity initiatives, as well as on significant existing and emerging cybersecurity risks, including cybersecurity incidents, as applicable.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Risks from Threats and Incidents We are subject to risks from cybersecurity threats and incidents to our vehicles and cloud infrastructure, including operational systems, security systems, integrated software and partners' data processed by us or third-party vendors or suppliers. However, as of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Our Business Operations."

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Infrastructure: Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Expensify, Inc.

ticker: EXFY


text: The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is the also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Hanover is committed to safeguarding the confidentiality, integrity, and availability of our information assets, including in particular customer information, and information technology environment. The objective of our cybersecurity program is to minimize the potential and impact of cyber threats. Our comprehensive cybersecurity program is designed based upon the National Institute of Standards and Technology ("NIST") cybersecurity framework and in accordance with applicable industry guidance inclusive of Federal Financial Institutions Examinations Council ("FFIEC") Information Security program guidance and NYDFS guidance and requirements.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our service providers focused on gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. As described below, we have risk management and governance practices and processes designed to address these risks.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors. We apply mitigations and processes based on our evaluation of the criticality of the vendor and the sensitivity of the data the vendor accesses. Our current vendor evaluation procedures include, as appropriate, an assessment prior to onboarding and implementation of cybersecurity-specific contract provisions. We are in the process of expanding and maturing these vendor risk management procedures.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for the oversight of risks from cybersecurity threats, if any. Information regarding any cybersecurity incidents would be shared with our board of directors or audit committee to enable assessments related to disclosure and notice requirements. We have not encountered any cybersecurity incidents since our IPO.

companyName: Churchill Capital Corp VII


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Head of IT in consultation with the legal team and our third-party security advisor. Currently, our Head of IT role is held by an individual who has over 20 years of information technology experience. The Head of IT reports to our Chief Financial Officer.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: As part of the above processes, we regularly engage with consultants, and other third parties, review our cybersecurity program to help identify areas for continued focus, improvement, and compliance. We engage them, specifically, to assist us with cybersecurity risk assessments, external threat environment reviews, internal cybersecurity policy compliance and near-term incident response. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our key suppliers, which have access to consumer, patient, and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We periodically perform diligence on certain third parties that have access to our systems, data, or facilities that house such systems or data; and we monitor cybersecurity threat risks identified through such diligence.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Our CISO has served in various leadership roles in information security, including serving as the Chief Information Security Officer at two other companies. Our CISO holds an undergraduate degree in Information Systems and a master's degree in Cybersecurity and Information Assurance and has obtained multiple professional security certifications including Certified Chief Information Security Officer. Our CDIO holds an undergraduate degree in Management Information Systems with minors in Computer Science and Economics and has served in various leadership roles in information technology, including serving as the Chief Information Officer of two public companies.

companyName: Shockwave Medical, Inc.


text: Our CISO is responsible for implementing the information security strategy, security engineering, enabling business partners, and securing customer data, digital assets, and payments. His organization also monitors cyber regulation requirements and reviews impacts of new products and initiatives. Our CISO has over two decades of experience as a cybersecurity professional, including as a CISO at PayPal and four other organizations including leading global financial services institutions and large scale U.S. government agencies (including within the Department of Defense). He has an extensive record of success shepherding digital transformation aligned with business goals, launching cybersecurity frameworks, building security engineering teams, ensuring protection of assets, data, privacy, and company reputation.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: Our Senior Leadership Team's Qualifications Our Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: The Managing Director – Enterprise Technology has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity holds the CISSP (Certified Information Systems Security Professional) designation, has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.

companyName: Onex Direct Lending BDC Fund


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks. We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates external resources to manage and monitor the evolving threat landscape, effective board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.

companyName: Two Hands Corp

ticker: TWOH


text: The Company recognizes the critical importance of maintaining the safety and security of its systems to protect its customers, maintain its reputation, and preserve the value of the Company and data and therefore have an enterprise-wide risk management framework for overseeing and managing cybersecurity and related risks. The process is supported by both management and its Board of Directors.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: Management, along with CCS Business Solutions, Inc., are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The individuals currently serving in these roles are the Chief Financial Officer as the representative of our management, and the CEO of CCS Business Solutions, Inc. The CEO of CCS Business Solutions, Inc. has over 20 years of experience in the technology industry, with most of that experience being specifically in cybersecurity. He also has formal education with a degree in Computer Science with a concentration in Artificial Intelligence, mainly involving self-learning algorithms.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: Management's Expertise The Company's Senior Vice President, Information Technology, holds a Master's degree in business administration and industrial psychology. He has served in various roles in information technology for over 26 years. Additionally, he stays informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques as staying informed on developments in the cyber industry is crucial to the Company's effective prevention, detection, mitigation and remediation of any cybersecurity incidents.

companyName: Steel Connect LLC


text: Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor error or misconduct, and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. We annually undergo an external penetration testing by a third-party cybersecurity firm. These tests and our tabletop exercises enable us to incorporate recommendations and learnings in our program. While we and third parties with which we do business have experienced cybersecurity incidents, to date, the Company does not believe that any previous cybersecurity incidents have materially affected the Company.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Our cybersecurity risk management processes, policies and CIRP are focused on (1) developing organizational understanding to manage cybersecurity risks, (2) applying safeguards to protect our systems, (3) detecting the occurrence of a cybersecurity incident, (4) responding to a cybersecurity incident and (5) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall risk management systems and processes. For instance, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection. We have engaged independent consultants and other third-parties to assist us in establishing and improving our policies. Our processes and policies include the identification of those third-party relationships which have the greatest potential to expose us to cybersecurity threats and, upon identification, we conduct additional due diligence as a part of establishing those relationships. We also maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. For a description and additional information concerning material cybersecurity risks we face, see Item lA Risk Factors - Information Technology and Cybersecurity Failures or Data Security Breaches Could Harm Our Business.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: The cybersecurity program includes: • a dedicated cybersecurity team; • operations, information technology and telecommunication systems implemented with segmentation and multiple levels of access controls; • a security operations center that continuously monitors information technology and telecommunications systems; • an incident response team composed of individuals from the information technology, operations, accounting, finance, legal, and communications departments, as needed, which is activated to respond to cybersecurity incidents; • periodic drills and exercises to address risks and prepare for extraordinary scenarios, including industry collaboration on incident preparation, such as GridEx drills hosted by NERC, participation in a full activation drill at least annually, and several tabletop drills during the year; • periodic drills with the full executive team, including the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Accounting Officer (CAO), Chief Information Officer (CIO) and General Counsel; • periodic information security awareness training and phishing simulations for employees and contractors who access our networks; • periodic security assessments of evolving risks and threats that lead to strengthening of cybersecurity measures; • implementation of automation solutions to strengthen detection and response capabilities; and • maintenance of cyber liability insurance.

companyName: WISCONSIN POWER & LIGHT CO


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the internal Security Incident Management Team or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: We maintain a cross-functional cybersecurity program to identify, prevent, and mitigate cybersecurity threats and incidents. The program also includes implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: PubMatic, Inc.

ticker: PUBM


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, VP of Finance, and Controller to manage the risk assessment and mitigation process.

companyName: AXT INC

ticker: AXTI


text: The Information Security team is responsible for monitoring and identifying all vulnerabilities and suspected threats and implementing corrective actions, if required. The Information Security team conducts risk assessments on the technology stack, determines effectiveness of internal controls, and develops remediation plans. The Information Security team utilizes specialized service providers to perform continuous monitoring, alerting and containment of potential threats, and penetration testing. The Information Security team maintains a Vendor Management Program and performs ongoing periodic risk assessments on third- and fourth-party vendors and their associated technologies, if applicable.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Our management team, led by our CISO, is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal cybersecurity team members and external consultants, threat intelligence and other information obtained from public or private sources, and alerts and reports produced by security tools deployed in our information technology environment. Our CISO has over 25 years and our CIO has over 10 years of experience in designing and implementing corporate information technology security systems and strategies. In addition, our CISO leads the operational cybersecurity team, which has an average of over 10 years of experience. Collectively, the members of the operational cybersecurity team have various certifications, including, but not limited to, CISSP, GSOM, GCIA, GCIH, CISA, CCSK, SSCP, GPEN, CEH, and CISM.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.

companyName: Bandwidth Inc.

ticker: BAND


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to management depending on the circumstances, including the individuals named above, who work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our security incident response plan provides for reporting certain cybersecurity incidents to our board of directors.

companyName: Snowflake Inc.

ticker: SNOW


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our management team, including R. LaDuane Clifton, Chief Financial Officer and Treasurer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes IT staff such as a Director of IT with more than 21 years of IT-related experience in various roles including managing information security, managing privacy and data protection, evaluating cybersecurity risks, developing cybersecurity strategy, and implementing cybersecurity programs.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: We cannot assure you that any of our new information technology systems or their required functionality will be effectively implemented, maintained or expanded as planned. If we do not successfully maintain our information technology or expand these systems as planned, our operations may be disrupted, our ability to accurately or timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may adversely affect our ability to certify our financial results. Moreover, our proprietary information could be compromised or misappropriated, and our reputation may be adversely affected.

companyName: Cenntro Inc.

ticker: CENN


text: Our Chief Information Officer and the Director of IT Security & Risk Management are the members of management that are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the company. The Chief Information Officer and the Director of IT Security & Risk Management work in coordination with the other members of the Information Security Governance Committee (the "ISGC"), which includes our Chief Financial Officer, General Counsel, Environmental Health & Safety Director, Vice President of Finance, Vice President of Information Technology, Executive Vice President of Industrial & Specialty Products, and the Director of Corporate Human Resources & Talent Management.

companyName: U.S. SILICA HOLDINGS, INC.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have not occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Our established recovery approach is designed to provide for the ready availability and use of our business-critical processes in the event of any downtime, disaster, or outages. We also seek to identify and mitigate the risks associated with the use of third-party service providers through the review of their security programs prior to our engagement thereof. Additionally, our control environment and internal audit process are designed to bring a systematic, disciplined approach to evaluate our risk management, control, and governance processes concerning cybersecurity and our information security framework.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Among other things, the program includes the following components: • security event monitoring and detection; • extended detection and response; • vulnerability scanning; • security awareness and privacy training for personnel; • phishing simulations; and a cybersecurity incident response team. The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: Our cybersecurity incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, Chief Legal Officer and Chief Executive Officer in their role as executive leadership for the Incident Response Team. The executive leadership team will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management policy include reporting to the audit committee for certain cybersecurity incidents.

companyName: Definitive Healthcare Corp.

ticker: DH


text: We also have a mature incident response process in place in the event a cybersecurity incident occurs. This process defines roles, responsibilities and action plans designed to contain and eradicate the issue and then restore systems in the event of a major disruption. Regularly, we conduct tabletop exercises to simulate responses to an incident and implement any insight gained from those exercises to improve our recovery practices. As part of these processes, we regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: The Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") and the Audit Committee and implemented and managed by the Company's Enterprise Information Security Steering Committee, a cross-functional team of senior executives representing business functions across Robert Half and chaired by the Chief Information Security Officer ("CISO"). The CISO oversees the Enterprise Information Security team ("EIS").

companyName: ROBERT HALF INC.

ticker: RHI


text: We leverage third party applications and software to help identify vulnerabilities within our system's boundaries. These vulnerability lists are used to create remediation plans and are prioritized based on severity and attack feasibility.

companyName: USBC, Inc.

ticker: USBC


text: Both the CIO and ISO regularly report to the Technology Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the Company's cybersecurity program and maturity assessment, while the Technology Committee and Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and ISO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Technology Committee and Audit Committee would be immediately notified and briefed.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: Malicious actors, which can operate on a larger and more sophisticated scale, are using various tools and methodologies to gain access to systems. Such attacks are ransomware, denial of service attacks, phishing, social engineering, and other cyberattacks. A breach of these systems either managed by us or a third party may result in the loss of business data, personal information, disruption of business.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: We rely on information technology and data to operate our business and develop, market, and deliver our products and services to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, software, and our confidential, personal, proprietary, and sensitive data (collectively, "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats. We have implemented an information technology security policy, which includes cybersecurity vulnerability management designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: OPAL Fuels Inc.

ticker: OPAL


text: Safeguarding information by securing our systems, data, and networks is a key priority for our business. Rocket Companies relies on our technology networks and systems, as well as those of certain third parties and affiliates, to collect, process, transmit and store information. We require the secure, efficient, and uninterrupted operation of those networks and systems to provide our clients with the best possible experience. With this in mind, we maintain an Information Security Program to protect the confidentiality, integrity, and availability of client information.

companyName: Rocket Companies, Inc.

ticker: RKT


text: During 2024, we realized our objective of having no material cybersecurity incidents. Furthermore, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties, during any of the last three years.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: We recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Inhibrx Biosciences, Inc.

ticker: INBX


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of our processes, we regularly engage with consultants, auditors and other third parties, including having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance. Our incident response plan requires that suspected cybersecurity incidents are promptly reported to our Controller and Chief Human Resource Officer and includes an escalation path to our Chief Executive Officer, executive leadership team, and board of directors.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: The service provider has demonstrated expertise in firewall management, intrusion detection, and incident response protocols. Internally, the Company's senior leadership team collaborates with the external provider and is responsible for ensuring that cybersecurity risks are effectively integrated into enterprise risk management practices. Although MWYN does not currently employ dedicated internal cybersecurity personnel, it leverages external expertise to support its cybersecurity operations.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: Mechanisms, controls, and technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: We have established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board of Directors through our Audit Committee, along with our executive management.

companyName: ITERIS, INC.


text: We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require will implement a cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to address potential cyber designing and evaluating our cybersecurity program, we will adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment and management processes and does not equate to compliance with any specific technical standards or requirements.

companyName: Idaho Copper Corp

ticker: COPR


text: Our board-level Risk Committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our enterprise risk management framework. The Risk Committee actively engages with our Chief Risk Officer and other members of management to discuss major risk exposures, establish risk management principles, and determine our risk appetite, and regularly reports on its activities, and makes recommendations to, the full Board. The Risk Committee receives a quarterly summary analysis of cybersecurity risks, threats, and incidents. In addition, the Risk Committee is engaged, as needed, in accordance with our Cybersecurity Incident Response Plan.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Audit Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Our overall enterprise risk management includes a third-party risk management program, through which we identify, monitor, and manage cybersecurity risks inherent in or related to external service providers and other third parties. Through our business lines, we actively assess and oversee our third-party service providers against requirements set by our third-party risk management program and our cybersecurity risk management program.

companyName: Axos Financial, Inc.

ticker: AX