text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Company follows an incident escalation process that is incorporated into its incident and risk management processes. In the event the Company identifies a cybersecurity incident, its senior management, consisting of the Chief Financial Officer, Chief Information Security Officer (CISO), Chief Administrative Officer, and Executive Vice President of Business Technology and Operations review the facts and circumstances involved in such cybersecurity incident, or series of related cybersecurity incidents.

companyName: NetApp, Inc.

ticker: NTAP


text: Risks and exposures related to cybersecurity attacks, including litigation and enforcement risks, are expected to be elevated for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking, and other technology-based products and services by us.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF

secItem: Item 1C


text: We use third-party service providers to perform a variety of functions throughout our business, such as software application providers, hosting companies, contract research organizations, and contract manufacturing organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The Risk Committee of our board of directors is responsible for the oversight of our Cyber Risk Program. The Chief Legal Officer provides quarterly updates to the Risk committee regarding the status, findings and developments within the Cyber Risk Program. In addition, the Risk Committee receives updates and presentations from the Senior Vice President, Information Security and Compliance (SVP) at each Risk Committee meeting that cover, among other things, our cyber incidents and responses, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs. The Risk Committee then reports to the full board of directors at each regular meeting of the board of directors. Additionally, at least one member of our board of directors possesses cybersecurity risk oversight experience, which contributes to the board's ability to understand and evaluate cybersecurity-related matters.

companyName: E2open Parent Holdings, Inc.


text: Our companywide Cyber Council, comprised of information technology and cybersecurity executives from our business units, shares information and cybersecurity practices throughout the company, recommends policy and procedure updates and tracks emerging trends. The chair of the Cyber Council reports directly to the company's chief executive officer.

companyName: GENERAL DYNAMICS CORP

ticker: GD


text: Our dedicated cybersecurity team, in coordination with our Chief Information Officer ("CIO"), assesses and manages risks by focusing on identity verification, system access controls, and governance, risk, and compliance processes. The CIO, with extensive information technology ("IT") and strategic leadership experience, is supported by a director of cybersecurity, a Certified Information Systems Security Professional with significant military cybersecurity expertise, and a team holding various industry certifications and having collective cybersecurity experience of over 75 years. The CIO regularly reports cybersecurity matters to the Chief Executive Officer and executive leadership, for alignment with broader organizational goals.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: PGE engages a third party to attempt to penetrate its systems periodically. The Company also uses a separate third party to conduct an assessment of its cybersecurity program maturity. These assessments allow PGE to upgrade processes and mitigate gaps regularly, rather than having a static program. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Security incident management processes designed to oversee, identify and manage security events and incidents, including a cybersecurity incident response plan and a managed 24/7 security operation center, which monitors all security events from endpoints and cloud services.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts.

companyName: AvePoint, Inc.

ticker: AVPT


text: We assess material risks from cyber security threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cyber security in alignment with nationally accepted standards.

companyName: ZION OIL & GAS INC

ticker: ZNOG


text: Our Audit Committee, in connection with management led by CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our incident response plan coordinates the activities we take in our efforts to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We regularly engage with independent third parties to review our cybersecurity program and assess the effectiveness of our controls. These third parties include our Internal Audit department as well as external reputable and well-known firms, all of which review various aspects of our cybersecurity program, processes, and controls throughout the year.

companyName: Bakkt, Inc.

ticker: BKKT


text: We design and assess our program based on a combination of the International Organization for Standardization (ISO) 27001, Center for Internet Security (CIS) 18, and the National Institute of Standards and Technology Cybersecurity Framework (NIST). This does not imply that we meet any particular technical standards, specifications, or requirements of these frameworks, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Commerce.com, Inc.

ticker: CMRC


text: incident reports and issued identified from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our regularly scheduled board meetings, the IT Technician regularly communicates with senior staff regarding emerging or potential cybersecurity risks. They discuss any significant developments in the cybersecurity domain, which when reported to the board, ensures the board's oversight is proactive and responsive. The board actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: To date, we have not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cybersecurity threats and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent. We cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: VSE CORP

ticker: VSEC


text: Our Information Security committee oversees this cybersecurity program and consists of senior management, including Mr. Swanson and our Chief Administrative Officer and General Counsel. At least quarterly, this committee reviews updates regarding cybersecurity threats and incidents that have occurred. Periodically, this committee approves cybersecurity strategy and initiatives proposed by our CISO.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: Our CIO has developed expertise in cybersecurity and compliance, enterprise architecture and road mapping, data and analytics, digital transformation and customer service through her 40 years of experience in the information technology space. She earned her computer science degree from Temple University and currently teaches in the Masters in Information Systems program at University of San Francisco. Our CISO has worked in cybersecurity for 26 years, including thirteen years as a CISO or deputy CISO. He is currently a Certified Information Systems Security Professional and holds an Information Systems Security Architecture Professional sub-certification (CISSP-ISSAP). He also holds a masters of science degree in computer science, with an information security specialization from James Madison University.

companyName: JUNIPER NETWORKS INC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."

companyName: scPharmaceuticals Inc.


text: Southwest Gas' incident response plan is designed to coordinate the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents. These activities include processes to triage, assess severity, communicate, contain, investigate, and remediate the incident, as well as to comply with applicable legal obligations and mitigate reputational damage.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: The CISO has served in various roles in information technology and information security for over 25 years, including in the telecommunications and management consultancy sectors and serving as the Chief Information Security Officer of two large public companies. The CDIO holds an engineering degree and has served in various senior positions in information technology for over 20 years, including serving as Senior Vice President, IT Sales, and Global Chief Information Officer at a public company. The CEO has served in various positions in finance and general management at PMI for over 30 years, including as Chief Financial Officer and Chief Operating Officer, and holds a master's degree in economics. The CFO has over 15 years of experience in finance and management, having held several executive positions in charge of finance, legal affairs information systems and industry administration at various companies. The GC has served at PMI for 18 years in several positions within the Legal & Compliance department, including as Vice President and Associate General Counsel of various regions, and holds two master's degrees having studied law, management and finance.

companyName: Philip Morris International Inc.

ticker: PM


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions on a regular basis to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.

companyName: Argo Group International Holdings, Inc.


text: Management Oversight Our CISO, who reports to our CIO, has overall responsibility for our enterprise-wide cybersecurity activities. The CISO is responsible for establishing the strategy, architecture, policies, procedures and standards related to cybersecurity across our organization. Each business then has a Security Lead, who reports to that business's IT leadership, responsible for the strategy, implementation and operation of that business's cybersecurity program (collectively, our CISO, CIO and the Security Leads are referred to as our "Security Team"). Our CISO holds a master's degree in information systems and has over twenty-two years of IT experience, including eight years of experience dedicated to cybersecurity and IT risk management. Having spent over twelve years at Post in various IT capacities, including approximately four years as the head of cybersecurity, his extensive knowledge of our IT systems and controls is instrumental in safeguarding our digital infrastructure. Our CIO's background encompasses approximately twenty-six years of IT experience, including approximately six years of cybersecurity and risk management oversight, and approximately six years in supply chain and business transformation leadership. This includes over thirty years in various roles of increasing responsibility at Bob Evans, which Post acquired in 2018, ultimately serving as the CIO of Bob Evans for approximately four years before becoming our CIO in 2022. His broad knowledge and significant experience enable him to have a holistic risk management view across our organization. In addition, members of our Security Team participate in industry specific organizations that allow us to share information about threats and risks facing our industry, share best practices across our industry and work together to find opportunities to strengthen our industry. Members of our Security Team also have established and maintain relationships with governmental entities, which have helped inform our cybersecurity incident response planning and the protection of our IT environment.

companyName: Post Holdings, Inc.

ticker: POST


text: Our information security team engages third-party services to conduct evaluations of our security controls, including penetration testing and independent audits. Annually, an external auditor conducts a System and Organization Controls ("SOC") type 2 audit covering the security principle for systems supporting our products.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: We have worked, and expect to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. As such, our DO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security. We also conduct periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it remains current, given the changing risk environment. The DO regularly updates cybersecurity matters to the executive management team.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our objective for managing cybersecurity as part of the information security program is to ensure adequate procedures and proper controls are in place in order to provide an objective system for recording and aggregating information, supporting the institution's strategic goals and objectives, and protecting the security and confidentiality of the institution's customers and business activities. Our information security program leverages guidance from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The information security program is periodically reviewed by the board of directors and updated by the Information Security Officer to adapt to potential new threats and conditions.

companyName: CITY HOLDING CO

ticker: CHCO


text: PPG maintains an internal communication hierarchy that is designed to communicate the occurrence of certain cybersecurity events and/or incidents into our systems to our CISO, our CIO, our company crisis response team, and, as appropriate, to certain members of senior management. This communication hierarchy includes protocols for informing the Audit Committee and the full Board of certain cybersecurity events and/or incidents and for determining the materiality thereof.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program primarily following the guidelines of the National Institute of Standards and Technology and Payment Card Industry Data Security Standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The objectives of our programs are to protect the confidentiality, integrity, use and availability of the Company's data; to protect against unauthorized access to the Company's data, the Company's network and information technology applications; and to maintain disaster recovery plans to prepare for and respond to the potential for disruption in the Company's information technology. To meet these objectives, the Company's Chief Executive Officer, website, and technical personnel manage our cybersecurity, information technology, and data privacy programs.

companyName: US NUCLEAR CORP.

ticker: UCLE


text: Cybersecurity Tools Our digital risk and security program deploys technical safeguards designed to help protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.

companyName: Premier, Inc.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and other specialists as appropriate to evaluate cybersecurity measures and risk management processes, including those applicable to the Company.

companyName: BC Partners Lending Corp


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.

companyName: Federal Home Loan Bank of Des Moines


text: Our IT Director reports directly to the Chief Financial Officer, which enables quick notification to the entire management team of any significant cybersecurity incidents. The management team and the enterprise risk committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our IT Director also reports at least annually to the audit committee about cybersecurity threat risks, among other cybersecurity related matters, and our Chief Executive Officer reports regularly to the chair of our board of directors, and the full board of directors, as appropriate, about any emerging threats to our operations, at scheduled board meetings and through communications between board meetings.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: While the Board of Directors, through the Risk and Compliance Committee, maintains oversight for cybersecurity risks, management is primarily responsible for identifying, assessing, and managing material cybersecurity risks within our broader risk management program. Management has established the Enterprise Risk Management Committee, headed by Company executives, to monitor the governance, risk, and compliance environment for Jack Henry, which includes review of cybersecurity risk. Management has also adopted specific policies and processes to monitor cybersecurity threats and to mitigate such threats as they arise. These policies and procedures include, among other things, an incident response program, which includes professionals with diverse backgrounds and skillsets, led by our CISO. Our incident response team is designed to monitor and assess cyber and information security related incidents. Any cybersecurity incidents that meet or exceed preestablished thresholds are escalated to management to establish the scope of the threat, apply mitigation and remediation efforts, and assess the need for disclosure to clients, third-party service providers, and regulators.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: We are focusing on cybersecurity risk, particularly as our operations become increasingly dependent on digital technologies for controlling our plants and pipelines, processing transactions and summarizing and reporting results of operations. Globally, as cybersecurity incidents are occurring more often and using increasingly sophisticated methods, we are at risk for interruptions, outages and breaches of operational systems, including business, financial, accounting, product development, data processing or manufacturing processes, owned by us or our third-party vendors or suppliers, or data that we process or that our third-party service providers process on our behalf. Any such cyber incidents have the potential to materially disrupt or shut down operational systems; result in loss of, unauthorized access to, or copying or transfer of intellectual property assets, trade secrets or other proprietary or competitively sensitive information; compromise certain information of customers, employees, suppliers or others; and/or jeopardize the security of our facilities. We collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary business information for our business and our customers, suppliers, contractors, investors and other stakeholders. We also work with third-party service providers that may in the course of their business relationship with us collect, store, process and transmit such data on our behalf.

companyName: HF Sinclair Corp

ticker: DINO


text: The Board of Directors oversees the Company's risk management program, including the management of cybersecurity threats. The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company's mitigation strategies. The TIS Committee provides Management oversight of the Company's cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Our Board of Directors exercises oversight over our risk management process directly, as well as through its various standing committees that address risks inherent in their respective areas of oversight. In particular, our Board of Directors delegates cybersecurity risk management oversight to the Risk Committee of the Board of Directors. The Risk Committee oversees our cybersecurity processes and policies on risk identification, management, and assessment. The Risk Committee also reviews the adequacy and effectiveness of such policies, as well as the steps taken by management to mitigate or otherwise control these cybersecurity exposures and to identify future risks. Our CIO reports regularly to the Risk Committee on cybersecurity and information security and the full Board reviews significant cybersecurity matters as appropriate.

companyName: NCR Voyix Corp

ticker: VYX


text: We have not identified material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "Cyberattacks and security vulnerabilities could result in material harm to our reputation, business, and financial condition." and "Technical problems or disruptions that affect either our customers' ability to access our services, or the software, internal applications, database, and network systems underlying our services, could damage our reputation and lead to reduced demand for our online marketplace services, information, and analytics, lower revenues and increase costs."

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: There is a risk of loss of corporate trust and sales opportunities due to system downtime or information leaks caused by the exploitation of vulnerabilities in servers, etc. We are conducting vulnerability assessments for services that are open to the public, and will continue to expand the scope of these assessments in the future.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: TEC's IT Business Continuity – Emergency Contingency Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to TEC's executive leadership and Board of Directors based on an assessment of the risk and other specified criteria. TEC has established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within Emera's enterprise crisis management framework.

companyName: TAMPA ELECTRIC CO


text: Our cybersecurity program is overseen by the Chief Financial Officer (CFO), who reports directly to the Chief Executive Officer (CEO) and updates the Board of Directors on cybersecurity matters.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by our Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). Our Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.

companyName: Terra Property Trust, Inc.

ticker: TPTA


text: The complexity and evolving nature of cybersecurity threats requires that we engage with a range of external experts, including cybersecurity assessors and consultants, in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights to be confident that our cybersecurity strategies and processes are consistent with industry best practices. Our collaboration with these third parties includes regular threat assessments and consultation on security enhancements.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial Officer, Chief Operating Officer and Chief Technology Officer and is chaired by our General Counsel, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee, together with the rest of our senior leadership team, to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, and periodic penetration testing and tabletop exercises.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: In addition, the Company's Executive Cybersecurity Oversight Governance Committee (ECOG), comprised of the Company's Chair, President, and Chief Executive Officer (CEO), Executive Vice President (EVP) and Chief Financial Officer, EVP and Chief Commercial Officer, EVP Customer Experience, Solutions and Services, and EVP, Chief Generation Officer and Enterprise Operational Excellence, receives monthly updates from the CIO and CSISO and provides senior management throughout the Company informational technology and operational technology perspectives, oversight and governance on investments and priorities for the broader cybersecurity organization, in addition to providing final decision oversight on recommendations and response to the ever challenging cybersecurity threat landscape. The ECOG also is leveraged to supply information and bring transparency to senior management throughout the company on the increasing threat landscape and the actions, response and road map to combat the threats.

companyName: PROGRESS ENERGY INC


text: In addition, we maintain internal "risk evaluation teams" dedicated to assessing and managing the entity-level risks facing the Company. There are two risk evaluation teams that relate to cybersecurity risk: Cyber-Attack Prevention and Cyber-Attack Recovery. The CAO and Vice President of Technology Operations participate in both risk evaluation teams. The CAO likewise serves on the Business Continuity Team as the business continuity technology lead, a role in which she comprehensively evaluates IT system readiness and preparedness should a business continuity event involving cybersecurity or technology interruption occur.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: As of the date of this report, though the Company and third parties have experienced certain non-material cybersecurity incidents, we are not aware of any cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, may materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A "Risk Factors" for a discussion of risks factors related to cybersecurity.

companyName: ONEOK INC /NEW/

ticker: OKE


text: We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. "Test" phishing assessments are periodically sent to our members. Any failures trigger a retraining exercise if not properly reported. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.

companyName: Woodward, Inc.

ticker: WWD


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing services to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.

companyName: PAYCHEX INC

ticker: PAYX


text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.

companyName: Ellington Credit Co

ticker: EARN


text: If a cybersecurity event occurs, the CISO leads the HTLF Incident Response Team as part of our Incident Response Plan designed to help reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled to mitigate material risks. The CISO and CRO work with key cross functional stakeholders, including members of executive leadership and provide updates to the HTLF Risk Committee on the status and impact of the cybersecurity event, as well as review the event with the Risk Committee following its ultimate resolution in order to share root cause and lessons learned from the incident.

companyName: HEARTLAND FINANCIAL USA INC


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the period covered by this report. However, institutions like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of increasingly sophisticated cyber actors. For a discussion of how risks from cybersecurity threats may affect us, see "Part 1 Item 1A. Risk Factors—"Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments."

companyName: KKR & Co. Inc.

ticker: KKR


text: We work with a third-party vendor, which has extensive cybersecurity expertise to help protect and defend our networks, physical systems, infrastructure, and data from cybersecurity threats. This vendor has advised us on material cybersecurity-related risks and helped us establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. These controls include a firewall protection that is implemented in all three of our facilities, antivirus software protection, two-factor authentication enforced on all endpoints including Windows PCs and laptops, and intrusion prevention software designed to automatically block any unauthorized access attempts on our servers. Our cybersecurity controls are embedded within our overall risk management processes and technology, including a 24/7 threat monitoring system provided by the vendor. We are in the process of developing and implementing procedures to oversee or identify material risks from cyber threats associated with use of third party service providers.

companyName: Shapeways Holdings, Inc.


text: In 2021, the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Risks from Cybersecurity Threats We are subject to increasing and evolving cybersecurity threats as cyberattacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. While none of the cyberattacks to which we have been subject to date have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience a material cyberattack in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyberattacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: As of March 31, 2024, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: ALTEROLA BIOTECH INC.

ticker: ABTI


text: Engage Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We have obtained various certifications from industry-recognized certifying organizations as a result of certain external audits. We also perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit and Finance Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our cybersecurity program includes an annual funding and forecast process, and we have further established processes to secure additional funding in response to emerging risks, threats and identified improvement opportunities. Our IS team, led by one of our Vice Presidents who also serves as our CISO, is responsible for assessing and managing risks from cybersecurity threats. The IS team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants.

companyName: Arista Networks, Inc.

ticker: ANET


text: The security of the National Vision network is monitored by a Security Operations Center ("SOC"), which works with our information security team with the aim of preventing realization of attacks by threat actors. We also maintain an incident response plan which, among other things, is designed to mitigate the impact of an incident, assist in restoring normal business operations, comply with applicable regulatory obligations arising from an incident and prevent similar future incidents. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers. Our Chief Technology Officer ("CTO") collaborates with our information security and legal teams to conduct periodic table-top exercises and testing of our data security and incident response procedures. Periodically, we engage specialized third parties to conduct exercises that stress test our data security systems and practice company-wide response tactics. We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. These service providers provide services such as threat intelligence and dark web monitoring. In addition, we engage independent third parties (such as assessors or consultants) to periodically assess the capability and maturity of our cybersecurity program.

companyName: Everpure, Inc.

ticker: PSTG


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.

companyName: CVRx, Inc.

ticker: CVRX


text: At least annually, management presents a cybersecurity report to our full Board of Directors along with semiannual briefings. These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Day to day management of cybersecurity risk sits with our Vice President of Information Technology ("ITVP") and his team. As noted above, the team conducts risk assessment activities on a regular basis. The team also liaises with cross-functional partners and outside experts, including legal counsel and consultants, and reviews applicable security frameworks (e.g., National Institute of Standards and Technology ("NIST")) to identify the legal requirements and industry practices and expectations that the Company's security measures should satisfy. The Company regularly updates its practices to incorporate new best practices and strengthen compliance with SOX, PCI-DSS and the Health Insurance Portability and Accountability Act requirements. These activities are used to develop and update the Company's cybersecurity risk profile.

companyName: Portillo's Inc.

ticker: PTLO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: The Board maintains oversight of risk from cybersecurity threats and is regularly briefed regarding emerging cyber risks, mitigation strategies and incident response protocols directly from the CISO. The Board includes at least one cybersecurity subject matter expert. The CISO periodically engages with the Board in an executive session to provide updates related to threat landscapes, security initiatives and other cybersecurity awareness within DFIN. The Board participates in tabletop exercises to better understand the Company's incident response planning and the Company maintains processes and procedures so that material risks or events are escalated and addressed appropriately.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: We also conduct periodic internal and third-party assessments to test our cybersecurity controls, perform cyber simulations and exercises, and continually evaluate our internal governing policies and procedures to help detect and respond to cybersecurity events in order to reduce harms or impacts from breaches and other information security incidents.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: Board of Directors and Board Committees Oversight of Risks from Cybersecurity Threats Logitech's Board of Directors oversees risk management and reviews Logitech security risks, controls and procedures. The Board of Directors is assisted in its role by each of the Audit Committee and the Technology and Innovation Committee. The Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a semi-annual basis from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity. The Technology and Innovation Committee periodically reviews the Company's cybersecurity, information security and other technology risks, controls and procedures, including product security and related threats. Finally, the Board has formed a Cyber Crisis Subcommittee tasked with overseeing any future significant cybersecurity crisis.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Given the size and scope of our operations, RCM and our officers use a third-party IT service provider to assist the Corporation in assessing, identifying and managing the material risks from cybersecurity threats to the Corporation and in administering our IT systems. We believe that our third-party IT service provider has sufficient knowledge, experience and capabilities to effectively assist the Corporation on cybersecurity matters.

companyName: RAND CAPITAL CORP

ticker: RAND


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, use of artificial information and machine learning applications, and asset use, and educates employees on the importance of reporting all incidents immediately. We conduct frequent phishing simulations requiring employees to identify and report simulated phishing emails. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: Despite facing directed attacks, our systems have withstood such challenges without material interruptions to our business operations. Recognizing the potential impact of significant disruptions, we remain steadfast in our commitment to fortify our systems against evolving threats. Any significant disruption to our ability to transact business could adversely affect our business performance as well as our reputation. Refer to Item 1A "Risk Factors - Our business operations could be disrupted if our information technology systems fail to perform adequately or are breached."

companyName: SunOpta Inc.

ticker: STKL


text: LSB utilizes an enterprise-wide risk management process to identify, assess and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber and technology risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting tools. Our team uses widely adopted methods and models to identify, prioritize and manage cyber and technology risks and develop related information security controls and safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other cyber exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical controls and address a wide range of current cyber threats. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: We have implemented various security measures to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is integral to assessing and managing our material risks from cybersecurity threats. While all members of management are involved in the review of these risks, our CIO has primary oversight of our cybersecurity program. Our CIO is a seasoned technology leader and change agent who has served as the top technology executive for multi-billion-dollar global organizations spanning diverse industries. With over 25 years of experience, our CIO has led business and information technology transformation, implemented global digital strategies, and optimized and integrated governance, risk, and compliance frameworks, processes and technologies in complex regulatory and industry environments. We believe our CIO's knowledge, skills and experience provide significant value to our Company.

companyName: MKS INC

ticker: MKSI


text: We design and assess our program based on various cybersecurity frameworks, most prominently the Health Information Trust Alliance ("HITRUST") Common Security Framework, and Service Organization Controls ("SOC") 2, developed by the American Institute of CPAs. In 2024, our cybersecurity systems, supporting infrastructure and EOS products received HITRUST e1 certification as they met the HITRUST CSF v11.20 certification criteria. We use this cybersecurity framework and information security controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.

companyName: Alphatec Holdings, Inc.

ticker: ATEC


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats alongside other risks is an integral part of our overall risk management system. This process is achieved by implementing specific controls, continuous monitoring, collaborative response plans, and regular reviews. Integration ensures a comprehensive view of risk and facilitates informed decision-making and a proactive approach to risk management. We employ various cybersecurity frameworks to ensure comprehensive protection of our systems and data, such as the NIST Cybersecurity Framework and elements of the CIS Controls Framework. By aligning with these standards and leveraging industry-specific best practices, we create a cybersecurity strategy to address the challenges of the solar power sector. Additionally, our cybersecurity disclosures are designed to align with the SEC's evolving guidance on cybersecurity risk management, ensuring we remain transparent and proactive in communicating our cyber risk posture.

companyName: Altus Power, Inc.


text: Our processes for assessing, identifying and managing material risks from cybersecurity threats are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which governs our cybersecurity oversight and management structure as well as our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Journal Technologies has a Chief Information Security Office (CISO) made up of internal cybersecurity practitioners who evaluate, identify, and mitigate significant risks posed by cybersecurity threats, with a focus on safeguarding the Company's technology, data, and intellectual property.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K. Any material failure, weakness, interruption or breach in security of our information systems or data, or those of our third party vendors, could prevent us from effectively operating our business.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our cybersecurity partners, including consultants, and other third-party service providers are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to maintain the performance and effectiveness of IT assets, data, and services. The cybersecurity partners provide services including, but not limited to, systems inventory management, vulnerability testing, user management, capacity monitoring, network protection, remote access management, data backups management, infrastructure maintenance, and cyber risk advisory, assessment and remediation. We also maintain a disaster recovery plan to help us quickly recover from an incident during a disruption and help mitigate the impact of certain cybersecurity risks.

companyName: Sachem Capital Corp.

ticker: SACH


text: Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 14 years in IT leadership roles and 6 years in cybersecurity program execution and oversight of information security.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: To evaluate the progress of its activities, our DTI function uses various industry and regulatory frameworks as guides to assess the state of the Company's cybersecurity program maturity and controls, including our organizational, people, physical and technological controls. The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen's Cybersecurity & Digital Trust Governance Council (which includes leaders from information security, compliance, regulatory affairs, manufacturing, audit, law and business development functions).

companyName: AMGEN INC

ticker: AMGN


text: CISO, who reports directly to the Chief Technology Officer, is a Certified Information Systems Security Professional with over 20 years of experience managing information technology and cybersecurity matters, including more than five years in gaming and three years at GAN Limited. Members of the information security team who support the security program hold relevant educational and professional credentials with experience in similar roles from other technology companies. The CISO and Information Security team, together with our Privacy and Data Protection Team, led by a dedicated Data Protection Officer are responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified any prior cybersecurity incidents that have materially affected us, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors".

companyName: GAN Ltd


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems and facilities to prevent an information compromise. We rely on commercially available systems, software, tools and monitoring to provide security for our information technology systems and the processing, transmission, and storage of digital information. We have also outsourced elements of our information technology infrastructure, and as a result, a number of third-party vendors may or could have access to our confidential information.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: The Board also receives presentations from management regarding trends in cybersecurity risks and risk mitigation initiatives and plans, including briefings on recent breaches at other companies and key takeaways and lessons learned that are applicable to our business. The Board will also periodically review key cybersecurity-related benchmarks for the Company.

companyName: Bally's Corp

ticker: BALY


text: Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Senior Technology/Cybersecurity Officer is primarily responsible for this cybersecurity component and is a key member of the Company's Information Technology Governance, along with our Chief Finance/Information Security Officer, including the Enterprise Risk Management Committee ("ERM"), the Information Technology Steering Committee ("ITSC") and the Information Technology Advisory Committee ("ITAC"), reporting directly to the Chief Information Officer. Our Senior Technology/Cybersecurity Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 31 years of cybersecurity experience, 6 of which was spent at the Company. The ITAC and ERM are board level committees with the ITSC consisting of members of management.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: President oversees processes for identifying and mitigating risks, including cybersecurity risks. The Company relies upon an outside third party security consultant for the security of its systems and relies upon third-party cybersecurity monitoring, alerting services, training, and use of secure cloud offerings to protect data. We have redundant systems to protect our current systems. Our outside consultant evaluates our security controls and provides overall information security strategy for the protection, detection and response capabilities used. The current consultant has extensive information technology and program management experience and evaluates our security with the ultimate goal of preventing cybersecurity incidents to the extent feasible.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business and operations may be materially adversely impacted in the event of a failure or security breach of our or any critical third parties' IT Systems or Confidential Information."

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: The Audit Committee receives annual reports concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: aTYR PHARMA INC

ticker: ATYR


text: To assist with its information security programs, the Company engages with multiple third-party providers and specialists, including firms with personnel credentialed by internationally recognized organizations such as ISC2, the SANS Institute, and ISACA. Services provided include but are not limited to network evaluations, configuration and vulnerability assessments, penetration testing, and business continuity planning, the results of which are shared with management along with any remediation plans. In addition, an annual information systems and security audit is conducted by the Company's internal audit provider with results reported to the Audit Committee of the Board. Information security matters also fall within the scope of periodic examinations by the Bank's primary regulator, the Office of the Comptroller of the Currency ("OCC").

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities to risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team and to our CIO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: Molecular Templates, Inc.


text: To identify and assess material risks from cybersecurity threats, our corporate risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our corporate risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including programs across identity and access management, training and awareness, threat management, cybersecurity operations, cybersecurity enablement, and cybersecurity data, host, and network security. This includes regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: We retain a third-party technology solutions firm (IT Firm) to help identify, assess and manage the Company's cybersecurity threats and risks. The IT Firm reports to an employee in our finance and operations department, who functions as our IT lead (IT Lead) and who works with our management team, including our Chief Financial Officer (CFO). Our IT Firm identifies and, in conjunction with our IT Lead, helps assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods and tools.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: The President oversees processes for identifying and mitigating risks, including cybersecurity risks. The Company relies upon an outside third party security consultant for the security of its systems and relies upon third-party cybersecurity monitoring, alerting services, training, and use of secure cloud offerings to protect data. We have redundant systems to protect our current systems.


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks.

companyName: California BanCorp \ CA

ticker: BCAL


text: Cybersecurity Program Overview GC Advisors has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. GC Advisors' cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. GC Advisors actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations, or financial condition. See the "General Risk Factors" section in Part I, Item 1A, Risk Factors for more information about the Company's cybersecurity risks.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our Chief Information Officer ("CIO") provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Our Advisor's cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape and knowledgeable teams responsible for preventing and detecting cybersecurity risks.

companyName: Net Lease Office Properties

ticker: NLOP


text: The CISO has over 25 years of business experience in information technology and cybersecurity and is a long-standing certified information systems security professional ("CISSP") with the International Information System Security Certification Consortium.

companyName: Baker Hughes Co

ticker: BKR


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it periodically updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: We have cybersecurity insurance intended to cover expenses related to notification, credit monitoring, investigation, crisis management, public relations, and legal advice. In addition, we maintain insurance to cover restoration of data, certain physical damage, and third-party injuries caused by potential cybersecurity incidents. However, damage and claims arising from such incidents may not be covered or may exceed the amount of any insurance available. Insurance policies and coverage are reviewed at least annually in detail.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Monitor Cybersecurity Incidents Our CIO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CIO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our management. Our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: We have an incident response plan that includes scenario-based playbooks for managing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.

companyName: GENTEX CORP

ticker: GNTX


text: We also have processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. To that end, we maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors and service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In addition, we perform diligence on our vendors and prospective vendors regarding their cybersecurity posture. We conduct and maintain a regular enterprise risk management program that is overseen by the audit committee of our board of directors, and efforts to address cybersecurity risks are an important component of our overall approach to enterprise risk management.

companyName: UPWORK, INC

ticker: UPWK


text: The Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity risks. The Board conducts oversight of management through board committees, presentations from senior leadership, and routine Board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Globally, organizations are encountering cybersecurity incidents with growing frequency, and the nature of these threats is becoming more sophisticated and constantly changing. We recognize the importance of developing, implementing and maintaining strong cybersecurity policies and processes to protect our information systems and the confidentiality, integrity, and accessibility and availability of our data.

companyName: FingerMotion, Inc.

ticker: FNGR


text: On an annual basis, we collaborate with the third-party consulting firm that performs internal audit services for us to conduct a risk assessment of information systems controls for managing changes, operations, security and system development life cycles. In addition, we review System and Organization Controls ("SOC") 1 or SOC 1 Type 2 reports for third-party service providers deemed significant to our environment. We perform the risk assessment and review of service providers in connection with Management's annual assessments of the effectiveness of internal control over financial reporting. They serve as the basis for developing an internal audit plan to test information systems controls as they relate to the effectiveness of internal control over financial reporting. The results of the internal audit conducted under that audit plan are reviewed by the Audit Committee of the Board of Directors (the "Audit Committee").

companyName: SURMODICS INC

ticker: SRDX


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, and Deputy Chief Information Security Officer ("Deputy CISO") help identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: The Chief Information Security Officer ("CISO"), and the Chief Information Officer ("CIO"), each play a pivotal role in informing the Board of Directors on cybersecurity risks. They provide comprehensive briefings to both the Board and the Audit Committee as part of managements reporting. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: The Company uses technologies and tools, as appropriate, to enhance cybersecurity, such as multifactor authentication, encryption, firewalls, intrusion detection and prevention systems, endpoint detection and response, vulnerability scanning, penetration testing, patch management and identity and access management systems. These systems are designed, implemented and maintained with the goal of identifying, assessing and managing cybersecurity risks. In addition to its internal cybersecurity team, the Company uses internal and external auditors and, as appropriate, third-party consultants, service providers and assessors to review and test its processes.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: In the ordinary course of our business, we process, store and transmit large amounts of data, and rely on third-party service providers to do the same, including sensitive personal information as well as proprietary or confidential information relating to our business or a third-party. The protection of information and business processes is an integrated component in our overall risk management program, and reflected in our Code of Ethics, security standards, and privacy policies. We employ processes to safeguard information and protect our members' data, including by deploying both proactive and defensive practices against the evolving cyber threat landscape. Examples of these processes include: a. Employing a qualified Chief Information Security Officer. b. Maintaining tools to identify malicious cyber activity. c. Monitoring risks posed by threat actors, including through partnerships with industry groups and government agencies. d. Providing annual cybersecurity training to our associates. e. Testing our associates' knowledge through internal phishing simulations.

companyName: HUMANA INC

ticker: HUM


text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. We review the overall incident response plan at least annually or as needed to determine what updates (if any) are necessary. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information, or intellectual property. Risk from cybersecurity threats, including relating to past incidents, have not materially affected our systems or business. Any significant disruption to our operations or access to our systems could adversely affect our business and results of operations. Further, a penetration of our systems or a third party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation, and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Risks Related to Cybersecurity, Data Privacy, and Information Technology."

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Security and privacy breaches may expose us to liability and harm our reputation and business " in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: Neuronetics, Inc.

ticker: STIM


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our operations, business strategy, regulatory compliance, results of operations, or financial condition. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against Company IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to Company service delivery; however, potential vulnerabilities to known or unknown threats will still remain. See Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: We have a dedicated cybersecurity team, composed of individuals with a diverse set of information security, cybersecurity, and governance, risk and compliance backgrounds, collectively giving our cybersecurity program significant experience. Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance. The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.

companyName: Allegiant Travel CO

ticker: ALGT


text: The Company utilizes various continuous monitoring methods for identification and notification of attempted unauthorized system access. Tools deployed throughout the Company track these attempts allowing for trend analysis and strategic adaptation. The Company has also established an incident response policy that thoroughly and systematically documents the Company's response and assigns responsibility to facilitate timely, organized and appropriate action during a security event or incident, including assessment of the impact and materiality of the event or incident. Incident management is led by the Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: While we lack a formal risk assessment policy or analysis and no process has been integrated into our management system, a risk assessment would likely include identification of any reasonably foreseeable internal and external risks, any likelihood and potential damage that could result from such risks, and whether existing safeguards are sufficient to manage such risks. If appropriate and necessary, we would implement reasonable safeguards to minimize identified risks and address any identified gaps in existing systems.

companyName: Hypha Labs, Inc.

ticker: FUNI


text: The Company recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. We have an enterprise-wide cybersecurity risk management program to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: Manitex International, Inc.


text: Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. In addition, our Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs our Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.

companyName: Carlyle Group Inc.

ticker: CG


text: The Company employs a combination of patch management, network security, malicious code prevention, and user awareness and training to assist with preventing cybersecurity incidents. Users are made aware of policies and procedures regarding appropriate use of networks, systems, and applications. Additionally, employees are trained in handling sensitive data and made aware of specific requirements when handling client data. Review and assessment of network infrastructure is completed, periodically. The Company, in certain instances, may rely on vendors, third-party support, or other outsourcing opportunities. Before introducing a new product or service, the internal controls and competence of a vendor, maintenance and upkeep of a third-party provider's systems, and financial condition of the third-party vendor are evaluated. Internal and external auditors and independent external partners are engaged and periodically review the Company's processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CITY HOLDING CO

ticker: CHCO


text: The audit committee receives periodic reports from the Executive Director of IT & Cybersecurity concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation.

companyName: ACELYRIN, Inc.


text: Our cybersecurity program is managed by our chief security officer ("CSO"). Our CSO is informed about and monitors awareness, prevention, detection, mitigation, and remediation efforts through regular communication and reporting from members of the information security team. Our CSO has served in information security roles for over 20 years, including serving as the Chief Information Security Officer for technology organizations and a government defense agency. He holds a masters degree in information systems and an undergraduate degree in electrical engineering. In addition, our chief technology officer ("CTO") has served in various leadership roles in information technology, engineering, and product management for over 25 years at public and private technology companies. He holds a PhD in computer science and undergraduate and masters degrees in computer engineering.

companyName: ZoomInfo Technologies Inc.

ticker: GTM