text: In 2023, the Company's Board of Directors established a standing Cybersecurity Committee to assist with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.

companyName: APA Corp

ticker: APA


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP

secItem: Item 1C


text: We aim to monitor these risks in connection with third parties in addition to our own operations. We collaborate with external cybersecurity consultants and auditors for independent audits and vulnerability assessments of our existing processes and systems. Our third-party cybersecurity risk assessment program is designed to oversee certain third parties and have those third parties adhere to cybersecurity standards. This program has measures to help further manage and attempt to mitigate potential cybersecurity risks arising from third-party engagements, including security audits, compliance checks for cybersecurity standards, risk evaluation procedures for certain third parties, contractual security requirements in certain third party agreements and monitoring tools. We conduct cybersecurity training with our employees as appropriate based on their roles within the Company.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: A vulnerability management program to scan and penetration test, on an ongoing basis, our systems and networks to identify and treat identified vulnerabilities.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: The Manager's Director of Information Technology, in coordination with relevant senior management and personnel of the Manager, which includes our Manager's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Manager's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Manager's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Incident detection and response plans: Maintaining real-time monitoring and implementing a structured incident response plan that allows us to quickly detect, respond to, and recover from cyber incidents.

companyName: cbdMD, Inc.

ticker: YCBD


text: We maintain a cybersecurity program designed to protect our systems and data from information security risks, including regular oversight of our programs for security monitoring. Gen has a process for identifying and assessing material risks from cybersecurity threats on a regular basis that operates alongside our broader overall risk assessment process, covering all identified enterprise wide risks. Cybersecurity risk is reviewed quarterly with management and with the board of directors. In addition, we regularly perform evaluations (including independent third-party evaluations) of our security program and our information technology infrastructure and information security management systems. Our processes also address risk and identification of cybersecurity threat risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, reviewing security and controls reports, implementing contractual security and notification provisions, and ongoing monitoring as needed.

companyName: Gen Digital Inc.

ticker: GEN


text: Verint takes steps to protect our data and third-party data we receive from our customers through the implementation of technological and organizational measures designed to reduce the risk from cybersecurity threats, including data theft or destruction.

companyName: VERINT SYSTEMS INC


text: Security Governance – The Company's Vice President and Chief Security Officer (CSO) regularly reports to the Board of Directors, providing updates on the threat and risk landscape and the management of cybersecurity incidents. Additionally, the Board has designated a subcommittee that meets quarterly to provide further oversight of the cybersecurity program. This subcommittee comprises board members and the executive leadership team. The CSO also leads a cross-functional, executive-level Security Council that meets quarterly to govern all aspects of the Company's security program.

companyName: CINCINNATI BELL INC


text: Policies and Framework Our cybersecurity efforts are governed by a set of policies to address data protection and security incident management, and overseen by our Security Incident Management Team ("SIMT"). Our policies are closely based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards, and we expect to review them at least annually. Our information technology standards and infrastructure safeguards include information security standards prescribed for use by NIST, security measures aligned with the ISO/IEC 27000 series of standards, the Sarbanes-Oxley Act and SSAE 18/ISAE 3402, privacy regulations compliance, and other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity and availability of our infrastructure and data and the resiliency of our operations.

companyName: PubMatic, Inc.

ticker: PUBM


text: Cybersecurity threat" means any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering. Our Vice President of Operational Engineering has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: As part of our commitment to a cloud-first strategy, we prioritize the use of SaaS-based solutions for critical business functions. These third-party providers conduct annual Statement on Standards for Attestation Engagements ("SSAE") audits, ensuring compliance with industry best practices.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: systems" means electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations.

companyName: Trans American Aquaculture, Inc

ticker: GRPS


text: In addition, information security education and training is conducted both at the time of hire and annually thereafter by internal employees and certain third parties. Training is designed to mitigate accidental information security incidents by employees. Phishing simulation testing activities are regularly conducted internally and by third parties to assess employees' competency at identifying potential threats.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. See "Risk Factor–Our inability to protect our IT Systems and Confidential Information from continually evolving cybersecurity risks, security breaches or other technological risks could affect our reputation and brand among our merchants and consumers and may expose us to material financial penalties and legal liability."

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A – Risk Factors".

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: NKGen Biotech, Inc.


text: Third-Party Review Processes —Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: 3. Monitoring and Response: PyraMax Bank maintains continuous monitoring capabilities to detect and respond to cybersecurity incidents promptly. Automated tools, as well as internal and external dedicated security teams, are utilized to monitor network traffic, system logs, and other relevant indicators of compromise.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: With respect to incident response, we have a cybersecurity incident response plan that applies in the event of a cybersecurity threat or incident that provides for responding to security incidents. The cybersecurity incident response plan sets out an approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The cybersecurity incident response plan is inclusive of the phases of the National Institute of Standards and Technology framework and focus: preparation; detection; and analysis; containment, eradication and recovery; and post-incident remediation. It applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: SILVERBOW RESOURCES, INC.


text: from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems.

companyName: enCore Energy Corp.

ticker: EU


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including notification of and escalation to the appropriate team members as well as executive management and the Board of Directors. The Incident Response Plan is coordinated through the Director of Technology Solutions and key members of management. The Incident Response Plan facilitates coordination across multiple departments and is evaluated at least annually.

companyName: FIRST OF LONG ISLAND CORP


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected us, or that are reasonably likely to affect us, including our business strategy, results of operations or financial condition.

companyName: POTBELLY CORP

ticker: PBPB


text: The board provides oversight of cybersecurity risks and has designated primary responsibility to the risk committee who oversees our information security programs, including cybersecurity, and is actively involved in monitoring the progress of key cybersecurity initiatives. Our board and risk committee receive regular updates on the activities and effectiveness of our GIS Program, including reports on incident response plan testing exercises and results of compliance testing and third-party evaluation results. Our CISO provides quarterly, or as needed. reports and updates to our board and risk committee on the company's cybersecurity risk management program and meets with the risk committee at least annually in a private session. The CISO has an indirect reporting line to the risk committee. We also engage with a leading professional consulting firm to provide regular updates to the board on cybersecurity-related risks in the evolving threat landscape and to provide education on best practices for board oversight of our GIS Program.

companyName: CME GROUP INC.

ticker: CME


text: TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including us. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Advisor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: Nuveen Global Cities REIT, Inc.


text: run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our technologies, methods and processes;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: We conduct risk assessments at least annually to identify cybersecurity threats based on the NIST CSF. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Real Estate Income Trust Inc.


text: To date, we have not experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Nexentis Technologies Inc.

ticker: NXTS


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo ' s risk management program, including with respect to cybersecurity, which is a critical component of Apollo ' s overall approach to enterprise risk management ("ERM"). Apollo ' s cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: The CISO is responsible for identifying and reporting any cybersecurity incidents to the Disclosure Committee. A preliminary assessment of nature and scope of potential incidents is conducted by a cross-functional team, including information security, compliance, legal, and other participants as necessary. Using a risk-based process, incidents are escalated to the Disclosure Committee. The Disclosure Committee is composed of senior executives from across Horace Mann and has oversight over SEC disclosure controls. After notification, the Disclosure Committee or designated subgroup would review known information and develop an action plan, which would include Board outreach, expert retention, insurance notification, communication plans, and a materiality assessment.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: We manage data security and privacy at the highest levels. Our Chief Executive Officer (CEO) is actively engaged in oversight of cybersecurity and IT infrastructure and works with outsourced vendors to manage all network operations. Our vendors keep our CEO informed on cybersecurity and privacy matters throughout the year. We have strengthened our data protection capabilities through investments in our infrastructure hardware and software. During the fiscal year ended May 31, 2025, the Company did not experience any material cybersecurity incidents.

companyName: Karbon-X Corp.

ticker: KARX


text: The board generally receives quarterly reports from our chief operations officer, chief information officer or other members of management, as well as periodic presentations from outside advisors concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Iridium Communications Inc.

ticker: IRDM


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This strategy includes employee training, innovative technologies, and policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, and third-party and independent reviews. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology (the "VP of IT").

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: The Company maintains an Incident Response Plan and a Crisis Communication Plan that provide documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Chief Information Security Officer (CISO) and is reviewed and tested at least annually. The Crisis Communication Plan, managed by the Director of Marketing and Alternative Delivery, is reviewed and tested at least annually.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: Our cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.

companyName: VOLITIONRX LTD

ticker: VNRX


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NGC Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: The Audit Committee oversees our cybersecurity risk management and strategy and has an oversight role that involves reviewing, establishing policies for, and assessing the efficacy of processes used to evaluate significant risk exposures and the measures management implements to mitigate these risks. The Audit Committee is informed about cybersecurity risks through regular management reports on the performance of internal and/or external cybersecurity audits and assessments and the effectiveness of existing cybersecurity practices. The Vice President, Information Technology, CISO, additional members of the SGC, and other personnel also annually update the Audit Committee on material cybersecurity risks, significant cybersecurity incidents, mitigation measures and impacts to the Company. The Board receives updates from management, including the Vice President, Information Technology, and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: QuidelOrtho Corp

ticker: QDEL


text: Our program is built on industry-standard frameworks, including the National Institute of Standards and Technology, and the Cybersecurity and Infrastructure Security Agency. We also follow applicable federal and state statutory and regulatory guidance and have adopted internal policies and standards in alignment with these federal and state requirements. Furthermore, we collaborate with external experts, consultants and auditors in routinely evaluating and testing our information systems controls. We also perform an annual pen-testing, cyber table-top exercise to help us test and refine our formal Cyber Incident Response Plan.

companyName: Green Plains Inc.

ticker: GPRE


text: Management and Strategy Roivant's corporate information security organization, led by our Chief Information Security Officer ("CISO"), is responsible for our overall information security strategy, policy, security engineering, operations and cybersecurity threat and incident detection and response centrally at Roivant and the majority of our Vants. Certain of our Vants, including Immunovant and our healthcare technology Vants, have established and maintain separate cybersecurity functions which are similarly designed to protect their information and assets from cybersecurity threats or incidents.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: We aim to deploy a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections. Our Board of Directors performs an annual review of our cybersecurity program, including management's actions to identify and detect threats.

companyName: Kuber Resources Corp

ticker: KUBR


text: Cybersecurity Risk Management Strategy The Company addresses cybersecurity risks through a comprehensive approach that is focused on preserving the security of its operations and information and ensuring the appropriate acquisition, access, use, or disclosure of PHI. Veradigm has implemented an enterprise-wide information security program ("IS Program") that is informed by core elements of the security standards encouraged by HHS, including relevant National Institute of Standards and Technology ("NIST") cybersecurity standards such as NIST SP 800-30, NIST SP 800-53, and NIST SP 800-63B, and ISO 27001and SOC2 suite of controls. Designed from a risk- and compliance-based approach, the IS Program is designed to protect Company information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction by identifying, preventing and mitigating cybersecurity threats, as well as effectively respond to cybersecurity incidents when they occur.

companyName: Veradigm Inc.


text: Maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf;

companyName: 5&2 Studios, Inc.


text: Risks from Material Cybersecurity Threats While we are subject to ongoing cybersecurity threats, we do not believe that the risks from previous threats have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations or financial condition. Nevertheless, we recognize cybersecurity threats are on-going and evolving, and our program is designed to identify and manage those threats. See item 1A. Risk Factors—Our technologies, systems and networks are subject to cybersecurity threats for more information on our risks relating to our technologies, systems, and networks.

companyName: CONOCOPHILLIPS

ticker: COP


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process designed to assess, identify, and manage material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: Director of Information Technology • Total of over 30 years' experience in Information Technology and Information Security in financial institutions. • 19 years' previous experience, prior to CapStar merger, with merged organization, with responsibilities overseeing information technology and information security. • Previously certified as community bank technology officer. • Five years' previous experience in auditing, including information technology and information security, with two other financial institutions. • Three years previous experience as a Tennessee bank regulatory where responsibilities included IT and Information Security examination responsibilities.

companyName: CapStar Financial Holdings, Inc.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including phishing training, regular network and endpoint monitoring, audits and vulnerability assessments to inform our risk identification and assessment.

companyName: Profound Medical Corp.

ticker: PROF


text: Cyber Risk Management Personnel The ISO directly reports to the CEO. The ISO regularly meets with the CEO to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Monitoring Cybersecurity Incidents The Company monitors cybersecurity events using multiple methods. The Company's 24/7 Security Operations Center ("SOC") has the ability to detect and respond to threats in real time and is authorized to shut threats down before they can harm the organization. Additionally, the SOC periodically performs pro-active "threat hunts," searching for potential indicators of compromise and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The Chief Information Security Officer is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker's artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The Chief Information Security Officer may determine that an incident has the potential to be materially relevant and would escalate that determination to the Cybersecurity Incident Disclosure Team comprised of the senior leaders, including the Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, outside counsel and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Transformation, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.

companyName: ZEUUS, INC.

ticker: ZUUS


text: Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee directly oversees our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: Paysign, Inc.

ticker: PAYS


text: Identification of Threats Associated with Third Parties Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.

companyName: Baker Hughes Co

ticker: BKR


text: The processes by which the Information Security Team and CISO monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents include regular vulnerability assessments and penetration testing, security incident and event management, continuous monitoring, and threat and intelligence gathering. The CISO reports to the Audit Committee on a quarterly basis, and as needed, to provide an overview of our cybersecurity risk posture, the effectiveness of our cybersecurity policies, procedures, and strategies, and any material or significant cybersecurity incidents that have occurred or are likely to occur.

companyName: ModivCare Inc

ticker: MODVQ


text: Getty Images engages third parties to conduct assessments to help it identify, categorize and manage cyber risks and to confirm compliance with applicable legal and regulatory requirements. Additionally, management and third parties conduct ongoing vulnerability scanning and performs penetration testing from time to time to help Getty Images identify and reduce the threat of known and emerging cybersecurity risks.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: We have implemented a cybersecurity risk management program intended to protect the security and availability of our critical systems and information. Our program incorporates certain guiding principles from the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program includes a cybersecurity incident response plan that consists of incident identification, classification, investigation and diagnosis, response, and recovery.

companyName: Five Point Holdings, LLC

ticker: FPH


text: Jack Henry systems and services undergo regular reviews performed by the same regulatory agencies that review financial institutions: Federal Reserve Bank ("FRB"), FDIC, Office of the Comptroller of the Currency ("OCC"), NCUA, and the CFPB, among others. Reviews such as those by the Federal Banking Agencies (comprised of the FDIC, FRB, and the OCC) assess and identify security gaps or flaws in controls. Critical services provided to our clients are subject to annual System and Organization Controls ("SOC") reviews by independent auditors.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Our board of directors is aware of the importance of managing the evolving and complex cybersecurity threat landscape, and has established oversight measures designed to manage associated cybersecurity risks. The Cybersecurity Committee is a decision-making body formed by our board that is tasked with advising and assisting the Chief Information Security Officer, or CISO, on cybersecurity matters and integrating major cybersecurity initiatives into our broader strategy. The Cybersecurity Committee is composed of board members whose backgrounds collectively include experience in risk management, technology, and finance.

companyName: MeridianLink, Inc.


text: We also have cybersecurity specific policies, standards and procedures, and our cybersecurity program has been developed based on industry standards, including the U.S. National Institute of Standards and Technology ("NIST") cybersecurity framework and International Organization for Standardization ("ISO") information security standards. Our information security management system has achieved ISO 27001 certification. To provide for the resilience of critical data and systems, to maintain regulatory compliance, to manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we regularly undertake the below listed activities: •24x7x365 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;

companyName: MSCI Inc.

ticker: MSCI


text: At least quarterly, the Audit Committee, Chief Executive Officer and senior finance and legal management, evaluate, review and discuss with the CTO our cybersecurity, privacy and data security programs, the status of projects to strengthen internal cybersecurity, results from third-party assessments, recent cybersecurity incidents at other companies and the emerging threat landscape. Significant cybersecurity incidents are reviewed and discussed with the Audit Committee and senior finance and legal management as required by our cybersecurity incident response plan.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Our governing policies, standards and procedures create a structured approach to managing cybersecurity risk. Information security requirements for employees, contractors and partners are detailed in the ConocoPhillips Information Security & Protection Policy. Our workforce is required to complete information security training annually, and we periodically communicate ways to recognize and avoid cybersecurity threats to our workforce.

companyName: CONOCOPHILLIPS


text: Verizon's comprehensive cybersecurity program is designed to identify and protect against cybersecurity risks and to position Verizon to rapidly detect, respond to, and recover from cybersecurity incidents that impact our company. The program is built on the following pillars: • NIST Cybersecurity Framework. Our program is aligned to the National Institute of Standards and Technology's (NIST) Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. • Risk identification. We continually assess the cybersecurity threat and vulnerability landscape using various commercial, government and publicly available information sources. • Risk detection. We use both manual and automated detection methods on a scheduled and ad-hoc basis to identify vulnerabilities within, and threats to, our operations and network infrastructure. • Risk evaluation. Once a cybersecurity vulnerability is detected, we assign a threat severity classification based on the risk profile associated with the vulnerability. • Remediation. Verizon's information security team reports all cybersecurity vulnerabilities and their associated threat classification to the appropriate business team for remediation. Deadlines for remediation are set based on the severity of the threat and closely tracked in a central system of record. In the instances when a remediation deadline cannot be met, the information security team and the business team work together to deploy appropriate mitigating or compensating controls until the remediation work is complete. • Metrics and analysis. We track the performance of our cybersecurity program by collecting, retaining and analyzing a broad range of data related to our threat identification, detection and response activity. We use this data to assess threat trends, for strategic planning purposes and to enhance management accountability for cybersecurity.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: As part of the information security program, Prudential conducts periodic exercises with independent outside advisers to assess the effectiveness of its program and its internal response preparedness. Prudential regularly engages with the broader security community and monitors cyber threat information.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and integrity of our data and information systems, along with other material risks to our operations, which we review with our IT leadership, information security steering committee, and Audit Committee at least twice annually or whenever there are material changes to our systems or operations.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: This new requirement in Item 601(b)(2) was proposed in 2022 by the SEC to "equip investors to better comprehend the level of cybersecurity risk the company faces" and "assess the company's preparedness regarding such risk," but also aligns with the SEC's 2018 guidance, which encourages companies to address the impact of any prior cybersecurity incidents in their risk factors. We expect many companies to provide a cross reference to existing risk factor disclosure on this point and to consider, as appropriate, any additional disclosure to address and clarify whether or not any cybersecurity incidents experienced to date have constituted a material cybersecurity incident. As the SEC noted, companies should likewise consider whether they need to revisit or refresh any previous disclosure made about cybersecurity incidents as they prepare this disclosure, including during the process of investigating a cybersecurity incident. 17 Governance Board Disclosure. Under new Item 106(c)(1), companies must: Describe the board of directors' oversight of risks from cybersecurity threats.

companyName: Energy & Water Development Corp

ticker: EAWD


text: We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive data. We prioritize a robust due diligence program for key third-party service providers, utilizing a comprehensive due diligence questionnaire to evaluate potential risks before establishing formal partnerships. This in-depth approach applies to all vendors with access to our sensitive systems or data. Our assessments are customized based on each provider's risk profile, with heightened scrutiny applied to new engagements and high-risk relationships. Existing vendors are subject to periodic reevaluations according to a predetermined schedule, with increased frequency for those deemed higher risk.

companyName: Perella Weinberg Partners

ticker: PWP


text: Board of Directors has oversight of the Company's cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.

companyName: Laser Photonics Corp

ticker: LASE


text: The Company's Chief Information Security Officer reports to the Company's Chief Information Officer who is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Chief Information Security Officer works in coordination with Company management. The Company's Chief Information Security Officer has served in various roles in information technology and information security for 26 years, including several Fortune 500 companies as a consultant specializing in risk management and security architecture, VP of Engineering for a payment solutions provider and security principal for an international telecommunications company in the Fortune 100, and has held many of the information security industry's most advanced certifications including ISC2's CISM (Chief Information Security Manager) and CISSP (Chief Information Security Professional), as well as an early adopter of the Cloud Security Alliance's CCSK (Certificate of Cloud Security Knowledge). The Company's Chief Information Officer has served in various roles in information technology for 22 years.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, operations, and our Company's overall IT environment; • A team of IT professionals principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) together with our legal/compliance team, our response to cybersecurity incidents; • Use of third-party service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including, without limitation, periodic penetration testing, network vulnerability and web application scanning, and system monitoring via System Information and Event Management ("SIEM") or other monitoring tools; • Employee and contractor trainings on information security awareness, data privacy awareness, and phishing/social engineering mitigation, as well as periodic tabletop exercises involving IT professionals and executive management to review roles and responsibilities and walk through practical aspects of responding to cybersecurity incidents; • A cybersecurity incident response plan that sets forth guidelines, policies and procedures for identification, escalation, containment, investigation, remediation, recovery, notification, legal compliance and related processes and actions in response to a cybersecurity incident; and • A risk management process for third-party service providers, suppliers, and vendors, which includes criteria for risk-based categorization of these third parties and policies and procedures relating to assessing their cybersecurity practices prior to engagement and periodic monitoring during the course of engagement.

companyName: REDWOOD TRUST INC

ticker: RWT


text: Our incident response plan outlines and coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan further outlines the roles and responsibilities of various employees, managers, and senior leadership with respect to performing a materiality assessment and responding to cybersecurity events that are deemed material, as well as provides rapid escalation procedures after a cybersecurity incident. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and our board of directors, as appropriate.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Our Board dedicates time and attention to our cybersecurity and information technology risks. The Board executes its cybersecurity risk oversight function collectively and by delegating responsibility to our Audit Committee. Our CISO presents to the Board at least annually and to our Audit Committee at least quarterly, covering a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments, and management's ongoing efforts to prevent, detect, and address internal and external cybersecurity threats specific to our organization. These briefings also include periodic third-party cybersecurity program assessments, benchmarks, and updates from our cybersecurity incident management exercises. Cybersecurity risks are documented and shared with our Audit Committee and the Board quarterly.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: We maintain a Cyber Incident Response Procedure that provides a documented framework for responding to actual and potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees and to the Enterprise Risk Committee of our Board of Directors. The Cyber Incident Response Procedure is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Cyber Incident Response Procedure facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our specific IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm; we regularly meet with our them to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks.

companyName: RADNOSTIX INC

ticker: INIS


text: Our formalized cybersecurity incident response plan is a framework to facilitate the detection, identification, containment and eradication of and recovery from cybersecurity incidents. This framework addresses how and which risks impact our operational, financial or reputational standing and/or the ability to comply with regulatory or legal requirements.

companyName: Globalstar, Inc.

ticker: GSAT


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the audit committee and the board of directors are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of material risks arising from cybersecurity threats. The Audit Committee regularly receives updates from management and third-party cybersecurity experts about major cybersecurity risks, their potential impact on our business operations, and management's processes to identify, monitor, and mitigate such risks, including, as relevant, the results of assessments or audits of our processes. The Audit Committee periodically provides updates on these matters to the Board of Directors.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: To support the CIO and Director of Cybersecurity in managing cybersecurity risks, we established a cross-functional cybersecurity team that includes experts in various aspects of information security. Combined, this team of employees includes individuals with over 85 years of prior work experience in cybersecurity and data protection. These individuals are responsible for the day-to-day implementation of our cybersecurity program.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Management has determined that no cybersecurity incidents that we have experienced to date have resulted in, or are reasonably likely to result in, a material adverse effect on our financial condition, results of operations, or business strategy. For additional information on risks from cybersecurity threats and potential related impacts on the Company, please see Item 1A. "Risk Factors."

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: Bank Security Policy To comply with all applicable federal requirements, the Bank's Board of Directors has adopted the Unified Bank Information Security Policy (the "ISP"), which establishes a program that the Bank's management and board can use to: Ensure the security and confidentiality of customer information;

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives semi-annual updates on topics related to information security and cyber risks and readiness from our management team, including our senior vice president of information technology. Management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including information security and cybersecurity risks, which are presented to the full Board at least annually as part of the Board's oversight of enterprise risk management.

companyName: HOST HOTELS & RESORTS L.P.


text: Our cybersecurity program is managed by our Chief Information Security Officer ("CISO"), who reports to our Chief Information and Digital Officer ("CIDO"). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the Company's information security team, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and results from third-party audits. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position since June 2022 and has over 20 years of experience in information security. His background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles in all areas of information technology. Our CIDO joined the Company in July 2023 with over 25 years of experience leading digital and information technology teams, including leading all aspects of her prior company's global enterprise digital roadmap, including finance, supply chain, and commercial solutions as well as data and analytics, including automation and artificial intelligence.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: We maintain a suite of policies – the Cybersecurity Policy, the Product Cybersecurity Policy and the Acceptable Use of Information Technology Resources Policy – that apply globally to all of our employees, businesses and functions, as well as third-party vendors and contractors as required by our legal agreements with them. These policies specify roles and responsibilities, fundamental principles and proper controls required for Xylem's protection. Our policies are reviewed annually to identify potential gaps or areas for improvement, considering changes in the Company, and its connected products and services, as appropriate. Our Code of Conduct, implemented by the Board, requires our employees' adherence with our policies and practices, including with respect to cybersecurity risk management.

companyName: Xylem Inc.

ticker: XYL


text: Logical Security: Access to the Company's information assets is governed by the IT Security Policy and Procedures document, which stipulates the procedure for granting new access, change in access, and access termination. All access changes are audited. All new system access is approved by designated data owners ensuring segregation of duties. We have a documented strong password policy for all users and all privileged access is restricted. All remote access is controlled using geofencing restrictions and requires multi-factor authentication.

companyName: International Seaways, Inc.

ticker: INSW


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect.

companyName: EyePoint, Inc.

ticker: EYPT


text: To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled "We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition" in Item 1A. "Risk Factors" in this Annual Report on Form 10-K.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO") proactively identifies, assesses and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to the Nominating Governance & Sustainability Committee or our full Board.

companyName: Kenvue Inc.

ticker: KVUE


text: The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."

companyName: 1ST SOURCE CORP

ticker: SRCE


text: Potential and actual cybersecurity incidents primarily are handled by our internal incident response team, which is supervised by our CISO. Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts. Depending on the severity and scope of the incident, we may also engage external consultants. Security personnel and consultants retained by our service providers may also be involved in cases where our vendors experience a cybersecurity incident. In the event of a potentially material cybersecurity incident, we have defined processes for escalating the incident for determination of whether the incident is material and requires filing of a notification on Form 8-K or other notification required under applicable laws and regulations.

companyName: GoDaddy Inc.

ticker: GDDY


text: The Bank's information security program and strategy are designed to ensure the Bank's information and information systems are resilient and appropriately protected from a variety of threats, both natural and man-made. Periodic audits and risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls and policies are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank information. These controls and policies include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and vulnerability management.

companyName: BCB BANCORP INC

ticker: BCBP


text: We believe that effective cybersecurity depends upon the successful implementation and maintenance of a comprehensive information security program. Deploying suitable security technology, which encompasses analytics and automation, and leveraging the expertise of highly skilled security and risk professionals, is crucial in our strategy. Additionally, we prioritize data governance and data-centric security as integral components of our approach in an effort to ensure compliance, uphold privacy standards, and safeguard customer and enterprise data.

companyName: Dayforce, Inc.

ticker: DAY


text: Our cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the NIST Cybersecurity Framework, and emerging business needs. Cybersecurity risks are continually monitored and shared with the executive leadership team on a quarterly basis. We maintain a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes designed to support our teams, our senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: There can be no assurance that our cybersecurity risk management program and evaluation and security processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in adequately protecting our systems, technology infrastructure and proprietary information. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors".

companyName: System1, Inc.

ticker: SST


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Vice President of Technology and Deployment (the "VP of Technology") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Castellum, Inc.

ticker: CTM


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our third-party IT service provider who reports to our Chief Technology Officer, to manage the risk assessment and mitigation process.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 29 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 26 years, including CIO of Gentherm Incorporated immediately prior to joining the Company. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.

companyName: PHINIA INC.

ticker: PHIN


text: Role of Management Our cybersecurity risk management program is built on three lines of defense, which collectively are designed to identify, assess, and manage our material risks from cybersecurity threats. Our Chief Risk Officer is responsible for implementing our enterprise risk management framework and reports directly to our Chief Executive Officer.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: We face a number of cybersecurity risks in connection with our business. To date, our business strategy, results of operations, and financial condition have not been materially affected by cybersecurity incidents. For additional information, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the risk factors under the section entitled "Risks Related to Intellectual Property, Information Technology, Data Privacy, and Security".

companyName: Palantir Technologies Inc.

ticker: PLTR


text: The Company's IS Program is comprised of five pillars: the Information Security Policy, the Enterprise Information Security Risk Assessment, the Incident Response Plan, a formalized Security Awareness Campaign, and an enterprise monitoring and reporting program.

companyName: Investar Holding Corp

ticker: ISTR


text: The CISO has been appointed by the Chief Digital and Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The CSC has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy.

companyName: Johnson Controls International plc

ticker: JCI


text: Additionally, we have established a cross-organizational IT steering committee, comprising senior and executive leadership, enterprise risk management representatives, and IT management, many of whom have over 15 years of experience and hold professional certifications in their respective fields. In an effort to build a comprehensive cybersecurity strategy across the organization, this committee convenes several times each year to discuss ongoing cybersecurity initiatives, emerging regulatory requirements and industry standards, and results of risk assessments.

companyName: ARGAN INC

ticker: AGX


text: Cyber risk assessments which identify cybersecurity business risks and the Company's cybersecurity gaps and vulnerabilities. Using agreed-upon key performance indicators (KPIs), stakeholders can measure the Company's cybersecurity capabilities clearly and objectively. This facilitates our ability to audit the effectiveness of future vulnerabilities and remediation activities.

companyName: Zedge, Inc.

ticker: ZDGE


text: To date, there have been no material cybersecurity incidents that have significantly impacted the Funds' business strategies, results of operations, or financial condition. The Sponsor continues to monitor our systems and processes to mitigate potential cybersecurity risks actively.

companyName: VS Trust

ticker: SVIX


text: Cybersecurity risks related to third-party IT providers and solutions are managed as part of our vendor security protocol that includes vendors, software, and cloud-based service providers. We partner with our vendors to minimize the customer data needed to provide services and ensure compliance with regulations. Vendors are reviewed annually to identify any changes to services, data requirements, and associated security and protections. Where applicable, vendors are contractually bound to protect customer data and support enforcement of all regulatory requirements. We proactively evaluate the cybersecurity risk of third-party IT providers and solutions by utilizing a repository of risk assessments and an external monitoring solution that includes threat intelligence to better inform us during contracting and vendor selection processes. When third-party risks are identified, we require those third-parties to agree by contract to implement appropriate security controls or refrain from doing business with them. Security issues are documented, tracked, and periodic monitoring is conducted for third-parties in order to mitigate risk.

companyName: TORO CO

ticker: TTC


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents, including known third-party provider incidents. However, there can be no assurance that our security efforts and measures, and those of our third-party providers, will be effective or that attempted security incidents or disruptions would not be successful or damaging. See "Item 1A–Risk Factors–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our reputation and business relationships could be damaged, which could adversely affect our financial condition and operating results."

companyName: Public Storage

ticker: PSA


text: Our Security Risk Committee is comprised of senior leaders across the company, and our Chief Security Officer briefs this committee on emerging risk topics and the company's top security risks on a quarterly basis. The Chief Security Officer also participates in our Risk Management Committee and presents on security risks as part of that group's discussion of enterprise risk.

companyName: HashiCorp, Inc.


text: As a part of our incident response plan, the CISO also reports and escalates cybersecurity incidents to the EMT and the Audit Committee as appropriate.

companyName: Hillenbrand, Inc.

ticker: HI


text: The Disclosure Committee, a senior executive leadership committee, assists in fulfilling our obligations to maintain disclosure controls and procedures and oversees the process of preparing our periodic securities filings with the Securities and Exchange Commission. Cybersecurity incidents, based on their severity, are escalated to the Disclosure Committee by the SIRT. The Disclosure Committee is comprised of the Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer and Chief Accounting Officer. The Disclosure Committee meets on a quarterly basis and more often, if necessary, and invites subject matter experts to meetings as appropriate. We have policies and procedures in place designed to provide appropriate information of any matters to our Disclosure Committee that should be considered in advance of applicable public filings, including cybersecurity matters, and to address the proper handling and escalation of information to management and the Board of Directors or a committee of the Board of Directors. In addition to the oversight by the Board of Directors, members of our management are responsible for assessing and managing material cybersecurity risks. Our CISO has over 34 years of experience in cybersecurity, applications, infrastructure and networks in information security.

companyName: UNISYS CORP

ticker: UIS


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program.

companyName: VALUE LINE INC

ticker: VALU


text: Depending on the environment, product, or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: performing risk analyses, establishing an incident response policy, having vulnerability management processes, and implementing certain security certificates for certain functions of our business; encrypting certain data, using network security controls; segregating data; maintaining access and physical security controls; managing, tracking, and disposing of assets; and monitoring our systems. In addition, we may refer to and perform assessments against the Center for Internet Security's Critical Security Controls to help inform our cybersecurity program, as well as perform assessments such as penetration tests.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Both our CISO and other members of our cybersecurity leadership team participate in threat intelligence briefings provided by various government and industry entities. Our CISO reports to the Chief Executive Officer, and the FedEx Executive Committee oversees our business risk, with cybersecurity threat risks being a regular topic of discussion. Our cybersecurity incident response plan includes processes for communicating cybersecurity incidents to relevant levels of management, including the DTRC, Executive Committee, the CyTOC, and the full Board of Directors, as appropriate, and consideration of external reporting and disclosure requirements.

companyName: FEDEX CORP

ticker: FDX


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.

companyName: AMEDISYS INC


text: Our Chief Financial Officer and our Senior Director, Head of IT and Informatics are the Company employees primarily responsible for assessing and managing material risks from cybersecurity threats with assistance from third-party service providers. Our Chief Financial Officer has served as a biotechnology executive for 15 years, whose responsibilities have included direct oversight of his companies' cybersecurity risks. Our Senior Director, Head of IT and Informatics has served as an information technology professional for over ten years and has held senior IT positions at multiple biotechnology companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: The identification and assessment of cybersecurity risk is integrated into our overall risk management systems and processes. We have an enterprise-wide information security program designed to identify, protect, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, circulated advisories, detection tools, conducting employee training, monitoring emerging laws and regulation related to data protection and information security. We also maintain a third-party security program to further assist us with the identification, prioritization, assessment, mitigation, and remediation of third-party risks.

companyName: NV5 Global, Inc.


text: The CISO, in conjunction with the CIO, the Chief Risk Officer and the Chief Legal Officer, manages the Company's cyber security posture. The current CISO has more than 20 years of experience in information security and information technology, including previously serving as the CISO for multiple large multinational corporations. In addition to his extensive work experience, the CISO holds a Bachelor of Science in Business Administration with an emphasis on Management of Information Systems from Alliant University and a Master of Science in Business Administration with an emphasis on Information Systems Audit from California State Polytechnic University. The CISO has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Fraud Examiner (CFE) and Federal Bureau of Investigations (FBI) CISO Academy Graduate. The CISO reports to the CIO and management on cybersecurity threats on a regular basis.

companyName: Rithm Capital Corp.

ticker: RITM


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from our Board of Directors (the "Board"), Audit Committee, employees and third-party experts. The Board, Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology ("IT") team reviews cybersecurity risks periodically, and we have a set of Company-wide policies and procedures concerning cybersecurity matters, including policies related to encryption standards, remote access, multi factor authentication, confidential information, the use of the internet, social media, email and wireless devices and incident response. These policies go through an internal review process by members of management and appropriate Board committees, as applicable.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: The Company implements and maintains technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include, for example: risk assessments, implementation of certain security standards and certifications, encryption of certain data, access and network security controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and an incident response plan. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's Information Security Team maintains a risk register related to information and security threats and evaluates and manages material risks from cybersecurity threats against our overall business objectives. This information is reviewed with the IT Steering Committee and communicated to the audit committee of the board of directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.

companyName: Vor Biopharma Inc.

ticker: VOR


text: The Company's results of operations, and financial condition were adversely affected by its previously disclosed September 2023 cybersecurity incident due to lost and deferred revenues, remediation expenses and billing and cash collection. However, the overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for fiscal year 2024. The Company is regularly subject to cybersecurity threats. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats.

companyName: Johnson Controls International plc


text: The Company's IT department is responsible for day-to-day management of potential cybersecurity risks. As part of its management of cybersecurity risks, the IT department conducts regular cybersecurity training of the Company's employees, which includes an annual training given to all employees and internal contractors, targeted trainings for employees and internal contractors with specific roles within the Company and simulated cyber threats, including phishing exercises that spoof common and novel tactics used by threat actors. The IT department, through the Company's head of IT, provides regular updates and reports to the Company's executive officers and the Risk Committee regarding cybersecurity threats, risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. The Company's executive officers and the Risk Committee provide guidance and approval of such items to ensure that such risks are mitigated and in line with the Company's overall risk management systems and processes.

companyName: Orion Properties Inc.

ticker: ONL


text: Risk Management Strategy The Company's cybersecurity risk management function is lead by the Vice President of Information Technology, who evaluates processes and activities within the Company's information technology infrastructure and automated systems. During 2023, the Company completed a detailed assessment to identify all technology and cyber tools currently in place and assessed its information technology personnel's cybersecurity capabilities and skill sets. During 2023, the Company focused on formalizing cybersecurity procedures and defining standards for risk identification and communication activities. The Company utilizes the National Institute of Standards and Technology guidance in all cybersecurity policies and procedures. Annual training for employees is required as well as ad hoc trainings for specific topics or events as deemed appropriate throughout the year. The Company also has cyber insurance to assist the Company both financially and operationally if a cyber event were to occur. Below is the basic framework used in the Company's risk management strategy: • Identify - set of procedures to identify assets to be protected, including computation, data, and integrity; • Protect - set of procedures to effectively engage and monitor adequate safeguards of critical infrastructure services; • Detect - set of activities, tools, and procedures to timely identify anomalies through continuous monitoring; • Respond - set of activities to effectively respond to and contain detected and confirmed cybersecurity events, and • Recover - set of activities and procedures to ensure any assets impaired because of a cybersecurity event are restored to use within the stated recovery point/time objectives.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Pulmonx Corp

ticker: LUNG


text: Our company is guided by a comprehensive cybersecurity framework to assess, identify, and manage material risks from cybersecurity threats. This framework is integrated into our overall quality and risk management system and is designed to protect our systems, data, and operations from cybersecurity threats. The framework includes policies to protect confidential information, guide periodic risk assessments, oversee and identify risks from cybersecurity threats associated with our use of third-party services providers, including through the use of a third-party risk management policy that accounts for such risks, and an incident response plan designed to detect, respond to, and recover from cyber incidents. Under this framework we may engage consultants and other third parties to assist in conducting cybersecurity risk assessments, implementing mitigation strategies, and testing the effectiveness of our cybersecurity controls.

companyName: VACCINEX, INC.

ticker: VCNX


text: We have experienced cybersecurity incidents in the past and, while none of these cybersecurity incidents resulted in a material disruption to our business, we may experience additional cybersecurity incidents in the future. As of the filing of this Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, refer to "Risks Relating to Our Business – A major failure of our information systems could harm our business; increased cybersecurity threats and more sophisticated and targeted cybersecurity attacks could pose a risk to our systems, networks and products." in "Item 1A. Risk Factors" within this Form 10-K.

companyName: TRIMAS CORP

ticker: TRS


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall risk management program. Such policies, procedures, and processes are designed to help protect our information assets and operations from internal and external cyber threats as well as secure our networks and systems. Such processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems and product applications, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. Our security incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.

companyName: Replimune Group, Inc.

ticker: REPL


text: The NG&S Committee is responsible for assisting our Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy and Digital Officer ("CPDO"). The CISO and the CPDO inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings. In addition, in February 2025, the CISO and the CPDO reviewed with our Board the cybersecurity and privacy programs, the Data Incident Response Program, and the role of our Board related thereto.

companyName: Kenvue Inc.

ticker: KVUE


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as those established by the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cybersecurity incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cybersecurity incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI") and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any cybersecurity events Blackstone experiences are reviewed, discussed, and incorporated into its incident response processes, as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: Blackstone Private Equity Strategies Fund L.P.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Audit Committee is primarily responsible for oversight of risks from cybersecurity threats. As provided for in the Amended & Restated Audit Committee Charter, the Audit Committee oversees the steps management has taken to monitor and control our data privacy and cybersecurity risk exposure. The Board delegated this responsibility to the Audit Committee in part because it includes members with significant experience and/or expertise in cybersecurity and other technology matters.

companyName: MKS INC

ticker: MKSI


text: Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We engage external experts, including cybersecurity assessors and consultants, to evaluate cybersecurity measures and risk management processes. We engage and depend on service providers to actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. Our finance and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such entities.

companyName: PhenixFIN Corp

ticker: PFX


text: The Vice President of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO