text: We have an overarching cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats that includes documented policies and procedures and incorporates a layered cybersecurity defense. We utilize a variety of technologies that are designed to target detection of malicious attempts to infiltrate our information systems. We also maintain an endpoint threat detection and response tool which uses artificial intelligence to alert our managed security service provider. On a regular basis, we hire a third-party cybersecurity service provider that performs a penetration test on our information systems and the Company seeks to address vulnerabilities that are found. We also utilize a third-party cybersecurity training company to educate our employees about cybersecurity threats. On a regular basis, we send out test phishing emails with a follow up email explaining to end users the "red flags" in these emails. Where appropriate, we utilize dual-factor authentication on our information systems. On an annual basis, we receive system and organization control reports from many of our key external IT vendors as these will reveal any sort of potential security issues these companies have had in the past year.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: The Director of Technology Solutions provides information security updates to the IT Steering Committee and the Risk Committee. Cybersecurity metrics are reported to the IT Steering Committee monthly and to the Risk Committee on a quarterly basis. Security training is provided to all staff through targeted training overseen by the Director of Technology Solutions. All Board members receive cybersecurity training annually.

companyName: FIRST OF LONG ISLAND CORP

secItem: Item 1C


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.

companyName: EXELON CORP

ticker: EXC


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management provides periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.

companyName: Cannaisseur Group Inc.

ticker: TCRG


text: Ali Mattera, Chief Digital Officer – Ms. Mattera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Information Security Risk Management and Strategy Our Board of Directors ("Board") is responsible for overseeing risk management at Whirlpool, which is the responsibility of our Executive Vice President and Chief Financial Officer. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: We may collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third-party information, and employee information. Our ability to manage our business functions efficiently and effectively depends significantly on the availability and security of this information. We seek to assess, identify, and manage cybersecurity risks through the processes described below: Risk Assessment

companyName: Enviva, LLC


text: Cybersecurity is a critical component of the Company's overall enterprise risk management program. Howmet has implemented a framework of principles, policies, and technology designed to protect our systems and data from cybersecurity threats. The Company's Board of Directors (the "Board"), through its Cybersecurity Committee, is actively engaged in overseeing and reviewing the Company's cybersecurity programs and risk management. Although past cybersecurity incidents did not have a material impact on the Company, including our strategy, financial condition, or results of operations, the scope and impact of any future cybersecurity threat or incident cannot be predicted. See Part I, Item 1A. (Risk Factors) for more information on how material cybersecurity incidents may impact the Company.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Company recognizes the increasing importance of cybersecurity in today's digital environment. As a company without active business operations, our current cybersecurity risks are primarily associated with the protection of sensitive company data, including intellectual property and personal information of our personnel and stockholders.

companyName: NEXIEN BIOPHARMA, INC.

ticker: NXEN


text: In addition, as discussed in more detail below under the caption "Cybersecurity Governance," the assessment, identification and management of cybersecurity risks have been integrated into our overall enterprise risk management ("ERM") efforts.

companyName: Angi Inc.

ticker: ANGI


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Financial Officer ("CFO") and Chief Compliance Officer ("CCO") regarding the overall state of GC Advisors' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity threat operation that endeavors to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the business. • Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments. • Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks with respect to third parties, including third parties who provide solutions we rely upon for our security measures. This includes contractually obligating third-party service providers with access to our systems or processing sensitive data on our behalf to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected security breach that may affect BlackLine. • Education: Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity. We provide training upon onboarding, and annually thereafter, for all personnel regarding cybersecurity threats, with additional role-based security training as applicable. We also provide periodic cybersecurity newsletters and updates to all employees, and have a phishing awareness program that includes monthly simulations, and we periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Incident Response Planning: We have established and maintain an incident response plan that addresses our response to suspected cybersecurity incidents and is tested periodically. • Communication and Coordination: We utilize a cross-functional approach to addressing the risk from cybersecurity threats, involving management personnel from the information security, technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Audit Committee of the Board (the "Audit Committee") and Technology and Cybersecurity Committee of the Board (the "Technology and Cybersecurity Committee") regarding cybersecurity threats and incidents. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our risk management function and Chief Information Security Officer ("CISO"). In February 2024, the Board formed a standing Technology and Cybersecurity Committee, which is comprised of independent members of the Board and assists the Board in fulfilling its oversight responsibilities with respect to risks relating to our information security, data privacy and disaster recovery capabilities.

companyName: BLACKLINE, INC.

ticker: BL


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. We have experienced both targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to limited, non-critical information and systems that were detected by our security processes. Nevertheless, we could in the future experience similar or more severe attacks. To date, no cybersecurity incident or attack, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".

companyName: GRAY MEDIA, INC

ticker: GTN


text: Our cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers. Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email verifications.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, penetration tests and consultation on security enhancements.

companyName: Matador Resources Co

ticker: MTDR


text: There have been no material cybersecurity threats or incidents nor are we aware of any cybersecurity risks reasonably likely to affect us, our business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K. However, future cybersecurity incidents could have a material impact on our business strategy, results of operations, or financial condition.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with Executive management and the Board of Directors.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire to identify the cybersecurity controls and protections maintained by a third party.

companyName: RLI CORP

ticker: RLI


text: The Company's Information Security program establishes policies, procedures, and risk assessments related to effective and efficient controls related to design and operations of the program. The Company also leverages regulatory guidance issued by the Federal Financial Institutions Examination Council (FFIEC) and frameworks to develop and maintain the information security program, including, without limitation the: FFIEC Cybersecurity Assessment Tool, National Institute of Standards and Technology (NIST) Cybersecurity Framework, and Section 501(b) of the Gramm-Leach-Bliley Act of 1999. Senior Management also monitors notifications from the U.S. Computer Emergency Readiness Team ("CERT") and the Financial Services Information Sharing and Analysis Center (FS-ISAC). Some of our procedures and controls include, without limitation: • Security Information and Event Management ("SIEM") logging and triggers, alerts, and 24/7 monitoring. • Endpoint Detection and Response ("EDR"), encryption, and backups. • Third party vendor risk management. • Disaster recovery and incident response plans. • Security awareness training, social engineering testing, and remedial training. • Vulnerability scanning, remediation tracking, and reporting.

companyName: CF BANKSHARES INC.

ticker: CFBK


text: Our cybersecurity program is managed by our Senior Vice President, Digital and Information Technology, or SVP of Digital and IT, whose team is responsible for leading our enterprise-wide cybersecurity policy, strategy, standards, and architecture.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology (NIST), the Federal Financial Institutions Examination Council (FFIEC), and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: Third party risk scores are weighted based on the classification tier and monitored over the course of the year. A change in risk score may trigger an audit for the third party as well as a remediation plan to address any identified gaps, which our information security team oversees in conjunction with the relevant business owner for the third party relationship.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: As part of our security program, we require all employees to take information security awareness training upon hire and annually thereafter. We provide additional ongoing training to our employees about security best practices and awareness, including internal phishing simulations.

companyName: PAYCHEX INC

ticker: PAYX


text: Oaktree faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Oaktree has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, Oaktree's business, business strategy, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Relating to Our Business – Oaktree's failure to maintain the security of its information and technology networks, including personal data and client information, intellectual property and proprietary business information could have a material adverse effect on us."

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information technology team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.

companyName: Seneca Foods Corp

ticker: SENEA


text: Our CISO brings over twenty years of broad technology leadership experience focused in the domains of cybersecurity, software engineering, and enterprise architecture. With a career spanning global organizations across different industries, such as retail, food service, defense and financial software, our CISO holds the following certifications: Certified Information Security Manager (CISM) by the Information Systems Audit and Control Association, Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both by the International Information System Security Certification Consortium.

companyName: Aramark

ticker: ARMK


text: We use, store, and process limited data related to our operations. As of the date of this filing, we have not yet implemented a formal cybersecurity risk management program designed to identify, assess, and mitigate risks from cybersecurity threats. We intend to implement a cybersecurity risk management program as our business operations and technology infrastructure evolve.

companyName: Natics Corp.

ticker: NTCS


text: We engage with third-party assessors, consultants, and auditors to test our cybersecurity maturity and to drive continuous monitoring and improvements. The engagement includes having independent third parties perform compliance, technical, and maturity assessments, such as (1) attack surface assessment, (2) penetration testing assessment, and (3) cybersecurity maturity assessments. We also annually engage third parties and/or our internal audit department to assess our information security programs, whose findings are reported to the Audit Committee of the Board.

companyName: Crocs, Inc.

ticker: CROX


text: • Artificial Intelligence ("AI"): The Company has established an AI Governance Policy and framework, overseen by the Company's Chief Information Architect, to ensure that all AI systems utilized or developed follow our data privacy standards, safeguard sensitive information and minimize potential vulnerabilities.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Our cybersecurity team plays a critical role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents on a day-to-day basis, including threats arising internally or from our vendors, suppliers or other third parties that we conduct business with. In addition, we have developed and implemented information security policies, standards, procedures and security guidelines that are based on industry standards, particularly the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Furthermore, we have implemented and maintained employee policies design to reduce risk of cyber-attacks and educate employees on protocol in the event of a potential cybersecurity incident.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: We have processes in place to identify, access, and address material cybersecurity threats and incidents with the help of the above noted expert third parties as needed. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: Shepherd's Finance, LLC


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from Endeavor's Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: Embedding cybersecurity within the broader enterprise risk management (ERM) strategies to evaluate cyber risks alongside financial, operational, and reputational risks, enabling executive leadership to make informed decisions.

companyName: Zedge, Inc.

ticker: ZDGE


text: The governance of cybersecurity risks is a critical function of our Board, with the Audit Committee playing a key role in the oversight of cybersecurity and related technology risks. The Audit Committee is tasked with monitoring the effectiveness of our cybersecurity risk management program as implemented by management.

companyName: Onconetix, Inc.

ticker: ONCO


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. See Item 1A. Risk Factors – General Risk Factors - Cybersecurity threats.

companyName: GORMAN RUPP CO

ticker: GRC


text: Management and Strategy have implemented internal controls including regular risk assessments designed to address financial, operational and information technology (including cybersecurity) risks and controls across our organization. These assessments are overseen by our Director of IT. We implement cybersecurity controls and procedures designed to address cyber risks and threats, supported by third-party technologies and security advisors and providers. We also provide cybersecurity awareness training to our employees during the onboarding process and periodically thereafter. In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments, and to evaluate our overarching information security program and specific incident response procedures. We also maintain a Cyber Incident Response Plan, which is overseen by our Director of IT and is designed to coordinate our response to information security incidents. Finally, we hold and maintain third-party insurance coverage for cybersecurity risks commensurate with industry standards for a company of our size and stage.

companyName: CALLAN JMB INC.

ticker: CJMB


text: Our proactive approach to cybersecurity involves the integration of leading technologies and collaboration with third-party experts to ensure alignment with industry standards. We believe these measures contribute to the protection of both our organization's and our clients' sensitive information.

companyName: Ingevity Corp

ticker: NGVT


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. The Company currently manages cybersecurity risks by working with third-party IT consultants and utilizing basic security protocols, such as network monitoring and access controls.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Federated Hermes' CIO has nearly 30 years of technology experience. Prior to assuming his current role in 2016, Federated Hermes' CIO served in senior technology roles with a large U.S. financial institution for over a decade where he, among other things, served as chief information officer for the asset management and investments businesses and gained deep experience managing cybersecurity risks and threats. He holds a Bachelor of Science (BS) in Electrical Engineering from the University of Pittsburgh, a Master of Science (MS) in Engineering from Youngstown State University, and a Master of Business Administration (MBA) from Carnegie Mellon University.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: During the fiscal year ended December 31, 2024, the Company did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or that are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition other than the risks described in Item 1A. "Risk Factors".

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the standardized framework established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. The NIST Cybersecurity Framework ("NIST CSF") helps the Company prioritize its cybersecurity activities and take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. We rely on a cybersecurity team that works to identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents through risk management and strategy. Our cybersecurity team has adopted procedures to promptly address material risks to the Company's cybersecurity environment, with a triage and remediation protocol in place. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and employee training, education, and awareness initiatives.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: As a highly regulated global financial services company, we understand the substantial operational risks for companies in our industry as well as the importance of protecting the information and data of our clients and employees. As such, our Global Informational Security (GIS) Program is designed and operated to mitigate information security risks and threats to the company. Its intent is to safeguard the confidentiality, integrity and availability of our information and services. The GIS Program is designed to strengthen the integrity of the global markets we support, protect CME Group's information assets, maintain client and employee trust, support our pursuit of strategic objectives, contribute to shareholder value and preserve our reputation and brand. We implement technical, physical and administrative safeguards to protect the confidential and sensitive information of our clients, employees and other information under CME Group's stewardship. We manage cybersecurity risk to the organization as part of our business strategy, risk management and financial functions in alignment with our overall Enterprise Risk Management Program and regularly engage with the risk committee of the board of directors and the board of directors as a whole regarding the effectiveness of the GIS Program.

companyName: CME GROUP INC.

ticker: CME


text: To ensure that our program is designed and operating effectively, we perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program. We believe our Chief Information Security Officer, who has over 20 years of experience managing information technology and cybersecurity matters, has the appropriate knowledge, experience and expertise to effectively manage our cybersecurity program.

companyName: Value Exchange International, Inc.

ticker: VEII


text: Cybersecurity Risk Management and Strategy First Wave BioPharma has established a comprehensive cybersecurity risk management program aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information. Central to our cybersecurity efforts is a robust incident response plan designed to address potential cyber incidents swiftly and effectively.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: While there are significant threats of all types in the modern connected world, studies show that phishing attacks and social engineering through email and other electronic means are of high concern. With the vast majority (some say as high as 95%) of such attacks originating via email, employee education on how to identify and handle suspicious email and other forms of communication is critical in protecting the data and infrastructure.

companyName: iCoreConnect Inc.


text: We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity threats.

companyName: SUPERIOR GROUP OF COMPANIES, INC.

ticker: SGC


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not been aware of any material cybersecurity incidents occurring and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "

companyName: STEEL DYNAMICS INC

ticker: STLD


text: For the year ended December 31, 2024, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Data Privacy and Cybersecurity" included as part of our risk factor disclosures at Item 1A of this Annual Report, which disclosures are incorporated by reference herein.

companyName: HCW Biologics Inc.

ticker: HCWB


text: We recognize the importance of assessing, identifying, and managing material risks to our Company associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader enterprise risk management program process, covering other Company risks. As part of this process our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Company's Chief Financial Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board and the audit committee. Our Chief Financial Officer works with our broader IT security team, including our specialty IT advisor. Our specialty IT advisor has over 25 years of experience leading technology oversight, and others on its IT security team have cybersecurity experience or certifications.

companyName: Perception Capital Corp. IV


text: Managing Material Risks & Integrated Overall Risk Management We maintain risk management activities to identify, assess, prioritize, and address cybersecurity risks and we incorporate them into our overall risk management processes. Our Security team is responsible for performing cybersecurity risk assessments over various systems and processes on an ongoing basis. The results from risk assessment activities are reviewed to prioritize the mitigation of identified risks, and the need for risk mitigation may influence business or operational strategy, project roadmaps and timelines, or other decision-making, as needed.

companyName: HashiCorp, Inc.


text: Our Board has oversight of our strategic and business risk management, including cybersecurity risk management, with support from our Audit Committee as described under "Governance" below. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our global information security program is led by our CISO, who brings over 20 years of industry experience.

companyName: Skillsoft Corp.

ticker: SKIL


text: The Company has strategically integrated cybersecurity risk management into our enterprise-wide risk management framework in alignment with the three lines of defense model to promote an enterprise-wide culture of cybersecurity risk management. This integration aims to provide that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our enterprise technology and cybersecurity management teams to evaluate and address cybersecurity risks in alignment with our business objectives, regulatory requirements and operational needs.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, which include: internal briefings from relevant personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. In addition, the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management and the Chief Information Security Officer to monitor and mitigate cybersecurity risks. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.

companyName: Intellicheck, Inc.

ticker: IDN


text: As a government contractor, we have designed our cybersecurity risk management program to align with the National Institute of Standards and Technology ("NIST") standards and comply with extensive regulations, including but not limited to U.S. government cybersecurity regulations. Additionally, our cybersecurity program is routinely assessed by the government and our network is penetration tested biannually by a third-party independent assessor. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations, including implementing certain security controls and complying with certain reporting obligations. Although we perform due diligence on all service providers to identify potential cybersecurity risks and establish controls through onboarding procedures and contractual requirements, our ability to monitor the cybersecurity practices of our service providers and ensure that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors is limited.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee of the Board. Our CISO has two decades of experience leading cyber security oversight with ten years in a multinational company environment. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.

companyName: Fossil Group, Inc.

ticker: FOSL


text: We have adopted an Enterprise Risk Management ("ERM") policy that includes cybersecurity risk management as a key area to which the ERM policy is applied. Our ERM program is designed to define the corporate risk tolerance and align assumed risks to that tolerance through risk identification, prioritization, assessment, mitigation and planned responses if risk is realized. These elements are applied to cyber-security as well as other origins of risk.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We also conduct table-top cyber exercises on an annual basis to ensure that the organization is prepared in the event that a significant breach actually occurs. These table-top exercises simulate a real cyber event (such as a ransom letter) in order to walk through the response process, gain information regarding how we react to incidents, identify areas of vulnerability, and recommend changes based on the outcome of the exercises.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: Management and Strategy recognize the critical importance of maintaining the safety and security of our systems and data and have implemented a holistic process for overseeing and managing cybersecurity and related risks. We depend on the accuracy, capacity, and security of our information technology systems and those used by our third-party service providers. To protect the confidentiality, integrity, and availability of our critical systems and information, we have developed and implemented a cybersecurity risk management program that includes a cybersecurity incident response plan. Our cybersecurity risk management program covers our business and was crafted following frameworks established by the National Institute of Standards and Technology. While using these frameworks guides our approach to identifying, assessing, and managing cybersecurity risks relevant to our business, it does not imply compliance with any specific technical standards, specifications or requirements.

companyName: Motorsport Games Inc.

ticker: MSGM


text: Following the Transactions, in order to support our comprehensive range of IT-related services and digital infrastructure, we have embraced a multi-layered defense approach, which helps us recognize and address the dynamic nature of cyber threats. By integrating diverse security measures, we aim to fortify our infrastructure against a spectrum of potential risks and adapt to the ever-evolving cybersecurity landscape.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Partnership recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. To this end, our processes are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems (including such risks associated with the use of any third-party service providers) that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by third-party experts under supervision of management, and, where necessary or desired, include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. We also consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: ReposiTrak, Inc.

ticker: TRAK


text: RadNet is committed to appropriate cybersecurity governance and oversight. Our Cybersecurity and Data Protection Program is the principal responsibility of our Chief Information Officer and Chief Information Security Officer, each of whom have over 20 years of experience in information systems, including cybersecurity training and experience. Additionally, RadNet's CIO and CISO work closely with our executive management, legal and compliance leaders, and meet regularly to discuss cybersecurity matters and risks.

companyName: RadNet, Inc.

ticker: RDNT


text: Pursuant to the Cybersecurity Policy, we conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Our cybersecurity policies and reporting processes are designed so that members of our senior management receive timely and adequate information regarding cybersecurity matters that impact the Company, including threats and incident response. We have implemented an approach to assess, identify and manage cybersecurity risks within our overall enterprise risk management program that shares common methodologies, reporting channels and governance processes and is based on a recognized framework established by the National Institute of Standards and Technology.

companyName: MOOG INC.

ticker: MOG-A


text: The Board of Directors (the Board) exercises cybersecurity oversight and control both directly and indirectly. The Board has designated the Audit Committee as the governing committee for the oversight of Murphy USA's major information technology risk exposures, including those related to cybersecurity, data privacy and data security, and to oversee the steps management has taken to monitor and mitigate such risk exposures. The Audit Committee reviews cybersecurity risks through regular updates from management as needed with no fewer than two reports from management per year, and it monitors the status of ongoing projects to enhance existing information security controls and practices and mitigate the potential risk from evolving cybersecurity threats.

companyName: Murphy USA Inc.

ticker: MUSA


text: On an annual basis, the CITO presents to the Audit Committee a detailed overview of our IT department's operations, including staffing and risks inherent in this functional area in order to apprise the Audit Committee, among other things, of our cybersecurity risks, how they arise throughout our business and what management's mitigation strategies are. The Audit Committee periodically engages third-party specialists to perform maturity assessments of our cybersecurity program. The Audit Committee reports on these matters to our board of directors as needed. In addition, the CITO periodically presents directly to our board of directors on our cybersecurity program.

companyName: Paramount Group, Inc.

ticker: PGRE


text: AHL's CIO has over 30 years of insurance and financial services operations and technology experience, having held numerous operations and technology leadership positions, including as the Global Business Information Officer of Consumer Businesses and Chief Information Officer of Life and Retirement at large insurance companies. He holds an undergraduate degree in Business Management and a master's degree in Management Information Systems. AHL's CISO is responsible for managing Athene's information security program. He has over 15 years of information security experience and is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer. He holds an undergraduate degree in Statistical Science and a master's degree in business.

companyName: Apollo Global Management, Inc.

ticker: APO


text: We have processes and programs in place to meet our global compliance obligations and work with our employees and teams across the globe to ensure security and data protection principles are integrated into the way we do business every day. We utilize a set of controls that integrate guidance from the EU's General Data Protection Regulations and align with the U.S. National Institute of Standards and Technology's ("NIST") framework. We undergo a regular independent assessment of our operational and strategic maturity across NIST controls and summary performance is shared with senior leadership including our board of directors. In addition, we submit to independent assessments by external parties, including System and Organizational Controls ("SOC") 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should. These functions are also supported by internal compliance teams who perform additional layers of testing prior to SOC 2 Type 2 procedures.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Risk Identification: We have developed risk identification and vulnerability management procedures that address the identification, prioritization, and remediation of cybersecurity vulnerabilities. To facilitate this program, the Company has created a risk register to assess and monitor potential risks. As discussed below, the Company uses certain third-party tools to identify and manage cybersecurity vulnerabilities. Each risk in the risk register is monitored by one of our cybersecurity members and updates are reported to the CROC as needed.

companyName: Vertiv Holdings Co

ticker: VRT


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. The Enterprise Security Director has over 27 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: INNODATA INC

ticker: INOD


text: The Company's Chief Information Officer has been serving in this role for the company for 18 years and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees an internal information security team, which works in partnership with the Company's internal audit department to review information technology-related controls with our external auditors as part of the overall internal controls process. The Chief Information Officer, who is in regular communication with the information security team, reports regularly to the Chief Executive Officer regarding vulnerabilities, new and developing threats, and compliance matters and also reports to the Audit Committee. The Audit Committee receives reports from the Chief Information Officer on a periodic basis, and more frequently, as needed, regarding cybersecurity-related matters. Such reports include updates with respect to existing and new cybersecurity risks, cybersecurity risk management and mitigation, cybersecurity incidents, as applicable, and key information security initiatives and recent developments.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: Phishing: Phishing attacks involve tricking individuals into revealing sensitive information such as login credentials or financial data by posing as a trustworthy entity via email, phone calls, or text messages.

companyName: International Seaways, Inc.

ticker: INSW


text: We maintain a cybersecurity program that is designed to protect our information, and that of our customers, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. We have implemented a comprehensive risk-based approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: Oversight of Third-Party Service Providers We engage many service providers in connection with our business operations. Some of these service providers play a minor role, while others perform services that are critical to our operations. We have a service provider oversight committee that oversees and facilitates the management of third-party relationships that are integral to our investment management activities. The committee maintains a written policy and other guidance that set forth our approach to managing and providing oversight of those third-party service providers in a manner consistent with the level of risk and complexity of the services provided. Our approach to oversight, which includes considerations regarding selection, initial and ongoing due diligence, contracting, ongoing monitoring and oversight and compliance with applicable regulatory and service level expectations, is tailored to each such service provider based on the scope of the services provided. Security assessments of those service providers may include questionnaires, meetings and onsite visits. We also consider contingency plans in the event a key service provider is not able to provide its respective services.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Additionally, in Item 1A Risk Factors, under the heading of Risk Related to Information Security and Business Disruptions, forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A Risk Factors should be read in conjunction with this Item 1C Cybersecurity.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: The Cyber Program is integrated into the Company's overall enterprise risk management process and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas. Cyber risks identified in the overall enterprise risk management process are reviewed annually by the Board.

companyName: PIONEER NATURAL RESOURCES CO


text: Our Director of IT is responsible for identifying, assessing, and mitigating cybersecurity risks across the Company. Supported by our Information Security team, the Director of IT monitors the cyber threat landscape, plans and implements security controls, and responds to incidents. The collective team has extensive experience in information security and cybersecurity risk management and performs detection and monitoring of cybersecurity threats and incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.

companyName: NexImmune, Inc.

ticker: NEXI


text: Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we may take seeking to mitigate and address those cybersecurity risks. The position of Chief Information Officer (CIO), which is currently vacant, leads our cybersecurity initiatives, managing a dedicated cybersecurity team focused on implementing and overseeing a robust cybersecurity program. The cybersecurity team has related academic degrees, certifications, and real-world experience in managing cybersecurity incidents and risks. The cybersecurity program emphasizes proactive prevention, detection, mitigation, and remediation of potential cybersecurity incidents. To promote transparency and informed decision-making, the CIO and cybersecurity team provide periodic updates regarding cybersecurity risks and initiatives to both our Cyber Incident Response Steering Committee and the Board of Directors. This ensures alignment and clarity among all stakeholders concerning our cybersecurity posture. By nurturing collaboration between our board, executive leadership, and cybersecurity professionals, we are devoted to protecting our digital assets and maintaining stakeholder trust. Our commitment to enhancing our cybersecurity framework equips FAT Brands to effectively address the dynamic threat landscape.

companyName: Fat Brands, Inc

ticker: FATAQ


text: The Audit Committee of the Board oversees XPEL's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Director of Enterprise Systems briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis.

companyName: XPEL, Inc.

ticker: XPEL


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight over our information security and technology risks, including oversight of management's implementation of our information security program. The Audit Committee receives quarterly reports from our Chief Technology Officer on our information security program, including any material cybersecurity risks. Additionally, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Our cybersecurity processes are overseen by the Audit Committee of the Board of Directors. The Audit Committee, through its charter, has express oversight of the Company's cybersecurity processes, controls, and procedures and is responsible for monitoring and reviewing the Company's mitigation efforts. The Audit Committee receives quarterly briefings from senior leadership, including our Chief Information Security Officer, regarding information security risk, strategy, and effectiveness and progress of the InfoSec program. The Audit Committee also reviews with management significant information security incidents for the period and associated remediation plans, and new or emerging information security risks. The Board of Directors is also provided an update quarterly on the Company's cybersecurity risk, processes, and mitigation efforts.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The CIO serves as Chair of the Company's management level Cyber Risk Committee, which provides oversight over the Company's strategy and controls to identify, manage and mitigate risks related to cybersecurity and incident response and resiliency associated with the Company's IT and OT environments, and is comprised of representatives from compliance, IT and OT cybersecurity, internal audit, legal and risk. The Chair of the Cyber Risk Committee reports to the Company's management level Risk Management Oversight Committee on a regular basis and both the Chair of the Cyber Risk Committee and the CISO report to the Board of Directors on a regular basis.

companyName: HF Sinclair Corp

ticker: DINO


text: We have a dedicated Cybersecurity Services team ("CST") devoted to information security which is led by the chief information security officer ("CISO"). In addition, our Security Operations Center provides near-real-time monitoring of network traffic going in and out of the enterprise to identify any abnormalities or indications of malicious behavior. We use managed security services providers to provide monitoring, threat hunting and response services through network and security log monitoring and a hosted security information and event management solution.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 17 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.

companyName: EVERTEC, Inc.

ticker: EVTC


text: At such time as the Company possesses sufficient resources, it will establish a cybersecurity policy appropriate for our business which implements protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. As part of this strategy, we expect to incorporate standard traffic monitoring tools, educate our personnel to identify and report abnormal activities, and partner with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: NETWORK CN INC

ticker: NWCN


text: Our cybersecurity team also maintains a comprehensive set of cybersecurity policies and standards. We continually reassess and review our cybersecurity strategy and policies, including through tabletop exercises, to identify and proactively address the constant changes in the global threat landscape. We also engage external vendors to assess the cybersecurity program as needed, including annual multi-stage penetration testing of our IT environment by independent third parties.

companyName: InterDigital, Inc.

ticker: IDCC


text: The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.

companyName: Phillips 66

ticker: PSX


text: The ERMC, which meets monthly, also monitors TransUnion's risk and governance policies and procedures to ensure that TransUnion risks are within the Board-approved Global Risk Taxonomy, which is described below. The ERMC reviews the broader risk environment and provides direction to mitigate (to an acceptable level) identified risks that may adversely affect our ability to achieve strategic objectives. The ERMC stewards our Enterprise Risk Management Policy and additional enterprise policies in risk-related areas, such as privacy and information security and key issues are reported to the appropriate committee of the Board.

companyName: TransUnion

ticker: TRU


text: The Company has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect the Company's on-site data center, and electrical power protection and generation facilities. The Company also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.

companyName: SITE Centers Corp.

ticker: SITC


text: TIAA's management team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms such as legal counsel, cybersecurity software providers and penetration testing firms.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: The board of directors, in coordination with the Audit Committee, oversees our management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with the members of management, including the CIO.

companyName: VERACYTE, INC.

ticker: VCYT


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including a maturity assessment of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.

companyName: NEWS CORP

ticker: NWSA


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD).

companyName: ESPEY MFG & ELECTRONICS CORP

ticker: ESP


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit and Compliance Committee (the "Audit Committee"). In connection with that oversight responsibility, our Chief Technology Officer and Chief Legal Officer meet with the Audit Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We may engage consultants, or other third parties in connection with our risk assessment processes. These service providers can assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: The information technology group has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. The group reports to our Chief Financial Officer. Our cybersecurity manager, who has held roles in security, infrastructure management, and enterprise information technology management, is responsible for assessing and managing the cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. We maintain processes to reduce the impact of a cybersecurity attack at a third-party vendor.

companyName: GameStop Corp.

ticker: GME


text: Our cybersecurity governance program is strategically integrated into our enterprise risk management and is periodically presented to the audit committee, which is responsible for oversight of the enterprise risk management framework associated with technology, security, data, and privacy, and the Board of Directors. These procedures include regular risk monitoring by management to update current risks and identify potential new and emerging risks. The Technology Committee receives regular briefings from our Chief Operations Officer, Chief Technology Officer, Chief Information Security Officer, and outside experts on cybersecurity risks and cyber risk oversight. During these meetings, the Technology Committee and management discuss these risks, risk management activities and efforts, best practices, lessons learned from incidents at other companies, the effectiveness of our security measures, and other related matters. The Technology Committee Chair reports on the committee's meetings, considerations, and actions to the Board at the next Board meeting following each Technology Committee meeting. The Audit Committee also discusses and receives updates on cybersecurity matters in connection with its oversight of enterprise risk management.

companyName: FOOT LOCKER, INC.


text: Cybersecurity is an integral part of risk management at our company. We have engaged a third-party cybersecurity firm along with our information technology director to monitor the cybersecurity risk facing our company and provide quarterly update to the Board of Directors (the "Board"). Cybersecurity is overseen by the Board and the Audit Committee of the Board (the "Audit Committee"). Pursuant to its charter, the Audit Committee has the responsibility and duty to review and discuss with management on a regular basis our company's programs, policies and procedures related to information security and data protection, including data privacy and network security, as they relate to financial reporting. The Board and the Audit Committee receive reports on cybersecurity from management at least quarterly and more often as needed. These reports on cybersecurity typically encompasses the nature and threats, defense and detection capabilities, and training activities at our company.

companyName: LTC PROPERTIES INC

ticker: LTC


text: The Senior Vice President of Information Technology leads an internal team that is responsible for assessing and managing our material risks from cybersecurity threats. The Information Technology team has primary responsibility for our overall cybersecurity risk management program and engages our retained external cybersecurity consultants as needed. The Information Technology team has also developed incident response playbooks that would be put into effect in the event of a Cyber Security incident and have exercised these playbooks in tabletop exercises with our external Cyber Security experts. The Senior Vice President of Information Technology has 25+ years of information management, governance, architecture and security controls management at Lifecore and other Fortune 500 organizations.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: Overseeing our cybersecurity initiatives is our Director of Information Technology who provides invaluable expertise in managing cybersecurity risks and leading our cybersecurity operations. The Director of Information Technology possesses good knowledge in information technology and program management, with contract resources available to help and supplement our security profile. Furthermore, the executive leadership team is active in security operations, overseeing implementation of policies, procedures, and policies related to cybersecurity, technology, and vendors. Both the Audit Committee of the Board as well as executive leadership team will be notified and updated in the event of an incident, with incident updates, mitigation efforts, and impact, as deemed appropriate.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: Our Board of Directors holds oversight responsibility over the Company's strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board of Directors and through its committees. The Audit Committee of the Board of Directors (the "Audit Committee") oversees the management of systemic risks, including cybersecurity. The Audit Committee engages in regular discussions with management and engaged consultants and legal advisers regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include the Company's risk assessment and risk management policies.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: Through our cybersecurity program, we continuously monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and of cybersecurity risk countermeasures made to defend against such threats.

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: We have not identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: OmniAb, Inc.

ticker: OABIW


text: Upon assuming the role, the new CTO conducted an initial IT and Security risk assessment. This involved employee sit--along, inventorying all tech systems and assets, and reviewing existing practices, procedures, and policies. The findings were meticulously cataloged, and a weighted scoring system was applied to rank risks based on impact and likelihood. Action plans have been developed and are being addressed in priority ranked order. These assessments will be updated quarterly, addressing new and outstanding risks and remediation plans.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: Management is responsible for identifying, monitoring and mitigating the material risks facing the Company, including cybersecurity risks. The Board of Directors oversees management's processes related to those risks. The Audit Committee of the Board of Directors is responsible for overseeing the risks associated with information technology and cybersecurity threats, and reports on its activities to the full Board following each committee meeting.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: Our Board receives periodic updates from management about our cybersecurity threat risk management and strategy processes. Additionally, upon detection of a cybersecurity threat, our Board receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such identified cybersecurity threat. Our Board also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our Board about material cybersecurity threat risks.

companyName: GRI Bio, Inc.

ticker: GRI


text: We rely on third -party vendors for certain operational and IT services. To mitigate risks associated with these vendors, we will implement a vendor risk management program that includes: Due diligence reviews of third -party vendors' cybersecurity policies and practices prior to, and during, potential engagement. Contractual requirements for third -party vendors to maintain robust security controls, where applicable, and report incidents promptly.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: While our business strategy and financial condition have not been materially affected by cybersecurity risks, we cannot guarantee future immunity. For more details, refer to Item 1A Risk Factors in our Annual Report on Form 10-K.

companyName: BIOLIFE SOLUTIONS INC

ticker: BLFS


text: Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight of the cybersecurity risk management program to the Audit Committee. On a quarterly and as-needed basis, the CFO reports to the Audit Committee on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The CFO also provides updates to the Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Infrastructure Co LLC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas. The cybersecurity risk management program includes: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment;

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our current CISO has over 30 years of industry experience leading enterprise cybersecurity teams and enabling secure and scalable ecommerce and payment platforms at multiple Fortune 500 companies. Since joining Visa in November 2015, he has been a core part of building Visa's Zero Trust Architecture and advancing VisaNet's cybersecurity defense capabilities. Our current President of Technology joined Visa in November 2013 and has over 30 years of experience in leading the development, deployment and operations of broad technology platforms including commerce and transaction technologies, which includes overseeing cybersecurity risk and transformational technology initiatives. At Visa, our President of Technology is responsible for the Company's technology innovation and investment strategy, product engineering, cybersecurity, global IT, and operations infrastructure, and for accelerating the integration of engineering and product teams.

companyName: VISA INC.

ticker: V


text: The Audit and Risk Committee of the board of directors is responsible for oversight of the Company's processes and policies for enterprise risk identification, management, and assessment, including certain risks around data privacy, technology, and information security. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Technology and Information Officer, Venki Krishnababu, who has over 30 years of experience in the information technology field. Prior to serving the Company, Mr. Krishnababu served in various information technology roles, most recently as Chief Technology Officer, at lululemon athletica inc. (NASDAQ: LULU), and prior to that as Chief Technology Officer at Premera Blue Cross.

companyName: Dutch Bros Inc.

ticker: BROS


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes company incident management and data protection policies, and applicable cybersecurity incident response playbooks.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST") and contractual, industry and regulatory best practices and requirements.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board's Audit Committee. The Audit Committee discusses with management not less than annually our significant financial risk exposures, including those related to data privacy, data security, and network security, and management's program to monitor, assess, and control such exposures, including our risk assessment and risk management policies. The Audit Committee reports to the Board as necessary concerning its activities, including making such reports and recommendations to the Board as it deems necessary and appropriate.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, including without limitation: • the probability of an adverse outcome; • the potential impact on financial results; • the likelihood of litigation or regulatory investigations; and • the potential impact on the Company's reputation and competitiveness.

companyName: Lazard, Inc.

ticker: LAZ


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors and/or the Nominating / Corporate Governance Committee.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Corporate Account Takeover Policy, which serves to mitigate the risks of corporate account takeover crimes and to document our compliance with the Texas Department of Banking's Supervisory Memorandum 1029 on "Risk Management of Account Takeovers," dated September 30, 2019, and the FFIEC's guidance on "Authentication and Access to Financial Institution Services and Systems," dated August 11, 2021;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: The Company has a comprehensive cybersecurity risk assessment program that systematically identifies, analyzes and evaluates potential threats and vulnerabilities that may impact the confidentiality, integrity, and availability of the Company's information systems and data. This program includes governance structure, risk identification, risk analysis, risk management, and risk communication and reporting.

companyName: TAPESTRY, INC.

ticker: TPR


text: Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.

companyName: UNIFIRST CORP

ticker: UNF


text: Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, overseen by the Company's Vice President of Information Technology and Chief Information Officer, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: We are led by our Director of IT, who is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with our senior leadership team. We also engage assessors, consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our cybersecurity risks and associated mitigations are evaluated by senior leadership and routinely by our Board of Directors.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: We conduct vendor security assessments for key service providers as part of our vendor onboarding process and as part of our contract review process. The cybersecurity assessment process includes considerations from an industry leading third-party vendor security ratings company.

companyName: HERBALIFE LTD.

ticker: HLF


text: HHH's Board of Directors recently formed a technology committee (the Technology Committee) to assume governance and oversight of our cybersecurity program from HHH's Audit Committee. This includes reviewing the cybersecurity program's strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events. The Technology Committee also oversees cybersecurity and digital strategy and, whenever necessary, will communicate with, or advise management to consult with, the HHH Audit Committee regarding technology, digital, and other innovation-related matters that relate to or affect the Company's internal control systems. The Technology Committee will actively participate in strategic cybersecurity decisions and will be responsible for approving major initiatives. Management will provide updates to the Technology Committee on a quarterly basis and will continue to provide updates to the full Board of Directors on an annual basis. When appropriate, the Technology Committee will inform HHH's Board of Directors on important matters. Furthermore, HHH's Board of Directors would be notified in accordance with the Company's incident response plan, of any suspected cyber incidents that may have at least a moderate business impact on the Company.

companyName: Howard Hughes Corp


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Finance and Risk Committee of our Board of Directors. The Finance and Risk Committee receives regular reports from management, including our Chief Information Officer (CIO), and reports to the Board of Directors at least annually on data protection and cybersecurity matters and reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to regularly scheduled Finance and Risk Committee reviews, we have in place processes and protocols by which certain cybersecurity incidents are reported immediately to the Company's executive leadership team, and subsequently thereafter, as appropriate to the Finance and Risk Committee.

companyName: FLOWSERVE CORP

ticker: FLS


text: IHM, in coordination with the General Counsel, is responsible for testing the Incident Response Plan on a periodic basis. In addition, the Audit Committee and the General Counsel will review on at least an annual basis the Incident Response Plan and update the Incident Response Plan, as appropriate, to address applicable legal requirements and the Company's policies, procedures and information security and business objectives. Periodically, the Audit Committee will review (i) the Cybersecurity Policies and (ii) the Company's cybersecurity risk exposure and discusses steps management has taken to monitor or mitigate such risk exposure.

companyName: Chatham Lodging Trust

ticker: CLDT


text: The sophistication of cybersecurity threats, including through the use of AI, continues to increase, and the controls and preventative actions that we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as AI may further expose our information systems to the risk of cybersecurity incidents. See Item 1A, " Risk Factors—Risk Relating to Our Industry, Business & Operations —Technology failures and cyber attacks, including, but not limited to, ransomware, exploitation in software or code with malicious intent, state-sponsored cyber attacks, as well as vulnerabilities relating to new technologies, such as generative AI, may impact us or our business partners and service providers, causing a disruption in service and operations which could materially and negatively impact our business and/or expose us to litigation."

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Any failure to maintain proper function, security and availability of our information technology networks and systems could interrupt our operations, our financial reporting and compliance, damage our reputation, and subject us to liability claims or regulatory penalties, which could have a material and adverse effect on our business, financial condition and results of operations. Management has not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.

companyName: RLJ Lodging Trust

ticker: RLJ