text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO provides a cybersecurity update to the full Board at least annually.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Our management team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity incidents. Our chief technology officer has over 41 years of experience and has held various leadership roles in information technology, including serving as a chief information officer and chief technology officer for the last 13 years. He has successfully implemented and managed large enterprise resource planning systems, e-commerce websites, stores and enterprise infrastructure, both cloud-based and on-premise. His expertise extends to evaluating and hiring cybersecurity personnel and outsourced managed services, defining incident response plans, conducting tabletop exercises, and establishing communication protocols with internal executives, board members, and vendors. He has firsthand experience in responding to actual cybersecurity incidents, showcasing a deep understanding of the challenges and complexities within the cybersecurity landscape in the retail sector. Our senior director of cybersecurity and compliance has a 16-year track record as an information technology and information security professional, complemented by an Executive MBA. His career is distinguished by a decade of leadership as the commander of the United States Army cyber protection team (174 CPT), where he gained cybersecurity experience at USCYBERCOM and ARCYBER.

companyName: Purple Innovation, Inc.

ticker: PRPL

secItem: Item 1C


text: We periodically assess and test our cybersecurity processes. These efforts include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage independent third parties to assess our cybersecurity measures, including audits and reviews of our information security control environment and operating effectiveness. The results of such assessments are reported to management's Risk Committee and to our board of directors. We adjust our cybersecurity documentation, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: TRUPANION, INC.

ticker: TRUP


text: As part of the Information Security and Cybersecurity Program, the Bank conducts periodic employee training to educate employees on information and cybersecurity risks and to reinforce security management practices and compliance with the Bank's security policies and standards. The training is mandatory for all employees and is supplemented by testing initiatives, including periodic phishing tests.

companyName: RBB Bancorp

ticker: RBB


text: As part of the above processes, we regularly engage external resources and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We periodically assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Following these risk assessments, we evaluate how to reasonably address any identified gaps in existing safeguards and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Business and Legal Officer, who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers by checking on a permanent basis every new vendor that is going to cooperate with the Company. The aim is to verify if vendors due diligence and risks associated with it are within our risk tolerance set by management.

companyName: Zedge, Inc.

ticker: ZDGE


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations, at least annually or whenever there are material changes to our systems or operations.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: The Company's Cybersecurity Committee is responsible for providing overall direction to reduce risk to company and Client data that resides in various systems, both in-house and with third parties. The committee duties are to ensure the confidentiality, integrity, and availability of such information. Further, the Cybersecurity Committee is responsible for (1) prioritization of Enterprise Strategic Planning for cybersecurity, (2) the review and approval corporate cybersecurity risk tolerance, (3) monitoring of cybersecurity threats and trends, (4) support of cross-functional collaboration on cybersecurity activities, and (5) promotion and support of cybersecurity awareness and decisions across the enterprise.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief of Staff, Chief Legal Officer and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: Our information security function helps identify, assess and manage the Company's cybersecurity threats and risks, as well as identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual tools, conducting scans of the threat environment, evaluating our industry's risk profile, evaluating threats reported to us, conducting internal and external audits, and conducting threat assessments for both internal and external threats.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: The Company recognizes that cybersecurity is fundamental to maintaining trust with shareholders, customers, and other stakeholders. By prioritizing cybersecurity as a strategic imperative, the Company strives to safeguard business operations, sensitive information, and integrity which preserves the value delivered to all the Company's constituents.

companyName: Virginia National Bankshares Corp

ticker: VABK


text: As referenced above, our Risk Council is responsible for day-to-day cyber risk management, and reports to the Audit Committee on these matters. Our management team, including our General Counsel, who serves as the lead of our Risk Council, and our CIO are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our internal security team is made up of experienced professionals that have an average of 27 years of IT and security experience, including certifications such as CISSP and CCSP from ISC2. We also have developed an internal training program to develop new talent within our organization and work with vendor and third-party training programs to mentor and educate these team members to expand and enhance the capabilities of our team.

companyName: ATN International, Inc.

ticker: ATNI


text: The cybersecurity program and related risks at CSX are managed by the VP Technology and CISO. The Company's CISO is a Certified Information Systems Auditor with over 30 years of industry experience including information security leadership positions at multiple publicly-traded companies. The CISO is supported by a team that includes the SOC, which consists of the Deputy Chief Information Security Officer ("Deputy CISO") and other cybersecurity professionals as well as a team of third-party contractors. The Deputy CISO has over 20 years of industry experience including federal cyber law enforcement.

companyName: CSX CORP

ticker: CSX


text: The Board of Directors receives quarterly reports from the CISO and CIO concerning NetScout's significant cybersecurity threats and risk and the processes NetScout has implemented to address them. The Board of Directors also receives various reports, summaries and presentations related to cybersecurity strategy, threats, risk and mitigation.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Technology, Risk and Finance Committee of our Board of Directors. The Technology, Risk and Finance Committee receives regular reports from management, including our Chief Information Officer (CIO), and reports to the Board of Directors at least annually on data protection and cybersecurity matters and reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. In addition to regularly scheduled Technology, Risk and Finance Committee reviews, we have in place processes and protocols by which certain cybersecurity incidents are reported immediately to the Company's executive leadership team, and subsequently thereafter, as appropriate to the Technology, Risk and Finance Committee.

companyName: FLOWSERVE CORP

ticker: FLS


text: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions to reduce, eliminate or manage risks. Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.

companyName: Cardlytics, Inc.

ticker: CDLX


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess the top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, "risk owners" are assigned to develop risk mitigation plans, which are then tracked to completion. The process's annual risk assessment is presented to the Board of Directors.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Management oversees the Company's risk management process, including cybersecurity risks, and receives updates regarding any cybersecurity incidents directly from the cybersecurity group as appropriate. The cybersecurity group is led by the Chief Technology Officer, who has over 15 years of experience in information security. Management will evaluate any cybersecurity risks, concerns and issues and determine whether to escalate such issues to the Board or any of its committees. Our Board is responsible for the oversight of management as well as the business and affairs of the Company. In carrying out this responsibility, the Board discusses and receives regular updates on a wide variety of matters affecting the Company.

companyName: New Fortress Energy Inc.

ticker: NFE


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by the Board, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Caterpillar's board implements its risk oversight function both as a board and through delegation to board committees, which meet regularly and report back to the Caterpillar board. Caterpillar's board has delegated the oversight of specific risks to board committees that align with their functional responsibilities. Caterpillar's Audit Committee (the "Caterpillar AC") assists the Caterpillar board in overseeing the enterprise risk management program and evaluates and monitors risks related to, among other things, Caterpillar's information security program. The Caterpillar AC assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Caterpillar's Chief Information Officer & Senior Vice President, Caterpillar IT (the "Caterpillar CIO") attends all bimonthly Caterpillar AC meetings and provides cybersecurity updates to the Caterpillar AC and Caterpillar board.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of mandatory training procedures and exercises to mitigate and remediate potential cybersecurity incidents. The CIRT members are comprised of representatives from management, including the Company's Chief Executive and Financial Officers, information technology, legal and communications teams. The CIRT reports to the Risk & Sustainability Committee of the Company's Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company. The Board has an active role in overseeing management of the Company's risks and regularly reviews information regarding the Company's operations, liquidity and associated risks. While each committee of the Board is responsible for evaluating certain risks and overseeing the management of those risks, the entire Board is regularly informed through committee reports.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: Impact of Cybersecurity Risks on Strategy and Results Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company believes that they are not reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The Company determined the impact of a past incident was not material, but enhanced its cybersecurity controls and processes in response to the incident. The Company has taken reasonable measures to protect against future compromise, and believes these measures will protect against material adverse impact, including its business strategy, results of operations or financial condition.

companyName: BELDEN INC.

ticker: BDC


text: Identification —monitor information technology systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document the incident.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: To date, ASB is not aware of any risks from cybersecurity threats, including or as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Bank, including their business strategy, results of operations or financial condition. For further information, see "Cybersecurity Events or other disruptions of our information technology systems could adversely affect our business" in Item 1A, Risk Factors of this Annual Report.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our board of directors have adopted a Cybersecurity Policy to serve as a standard for setting, reviewing and implementing our cybersecurity goals, objectives and targets. Our Cybersecurity Policy serves as a framework within which risks the confidentiality, integrity or availability of our assets within our information technology network and infrastructure (" Cyberspace "), and applies to all of our directors, officers, employees, consultants and contractors. We regularly perform evaluations of our security program and continue to implement controls aligned with industry guidelines to identify threats, detect attacks and protect data. Our risk management strategy is focused on three areas: (i) technology, being our hardware and software systems; (ii) processes, being our cybersecurity reporting, testing and other processes; and (iii) people, which refers to our internal cybersecurity personnel, external service providers and individual training and human interaction within our information technology and cybersecurity processes.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: Cybersecurity Risk Management Personnel Our VP of Technology, Shaam Farooq, has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Mr. Farooq has over 25 years of global technology leadership experience in the oil and gas, technology, manufacturing, and automotive industries. Mr. Farooq has led the technology functions and overseen the cybersecurity and digital transformation of startups and Fortune 100 companies alike and brings deep domain expertise and hands on experience to his role. His background includes extensive experience as an enterprise CISO and is an active participant in the oil and gas cybersecurity community, keeping abreast of late breaking threats and remediations. Shaam continues to refresh his Certified Information Systems Security Professional and Certified Information Security Manager trainings as schedule permits.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.

companyName: Remitly Global, Inc.

ticker: RELY


text: The Company builds information security awareness among our employees by conducting regular training on our cybersecurity and data protection policies and executing vulnerability testing with employee simulated email threats. The Company also regularly updates employees on cybersecurity issues, assesses for susceptibility to email phishing and provides tools to alert the global information security team to potential phishing activity. Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns to the Company, including the Brink's GSOC and the Brink's Ethics Hotline. We believe providing ongoing training and real-world learnings to the Company's workforce is a crucial part of ensuring security and defending against future attacks.

companyName: BRINKS CO

ticker: BCO


text: The audit committee, in turn, provides periodic reports to our board of directors regarding our cybersecurity processes, including the results of cybersecurity risk assessments.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: Network Security: We deploy firewalls to shield the Company's network from malicious or untoward network traffic that violates security policies. Our firewalls are equipped with intrusion detection and intrusion prevention systems to detect and prevent potential attacks.

companyName: International Seaways, Inc.

ticker: INSW


text: FactSet's information security team performs annual penetration testing with leading service providers, to mimic motivated threat actors, to assess the internal and external security posture of the Company. Findings from the penetration test and our internal and external vulnerability assessments are classified using a combination of scores and internal business metrics.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Our cybersecurity risk management and strategy processes are led by our Senior Vice President and Chief Information Officer ("CIO") and are supported by the Senior Director of Enterprise Cyber Security. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current CIO has over 25 years of experience in information technology matters, and has over a decade of experience at the Company. Our Senior Director of Enterprise Cybersecurity has over 20 years of expanding leadership experience in information technology and 17 years of experience in information security leading and developing security programs. Our CIO provides regular updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software (collectively, "Information Systems"), and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature (collectively with Information Systems, "Information Systems and Data").

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: The Board established the Cyber Security Committee of the Board in December 2022 to augment the Board's oversight with cybersecurity focus and expertise and to complement the risk framework activities of the Enterprise Risk Management and Credit Policy Committee. The Cyber Security Committee considers risks associated with Horizon's overall cyber security and information technology programs; information technology audits; the security risk insurance that Horizon maintains for information technology, cyber security and privacy risks; Horizon's information security training programs; and compliance with all rules and regulations and risk control policies and procedures relating to information technology and cyber security. Pursuant to the Cyber Security Committee Charter, the Cyber Security Committee is required to meet at least three times per year and report to the Board annually. The Cyber Security Committee met three times in 2024. In addition, the Cyber Security Committee Charter provides that a majority of the Cyber Security Committee's voting members must qualify as independent directors under SEC rules and NASDAQ listing standards. During 2024, 3 of the Cyber Security Committee's members qualified as independent.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: The Board delegated primary oversight authority to the Audit Committee who plays a pivotal role in ensuring the effectiveness of our cybersecurity strategy. Through regular updates provided by our leadership team, the committee actively evaluates the organization's cybersecurity posture and aids in prioritizing risk mitigation efforts aligned with our strategic objectives. These updates encompass detailed quarterly reports during audit committee meetings, covering key metrics, ongoing initiatives, and any cybersecurity incidents. Additionally, on an annual basis, the entire board receives updates on the progress of our cybersecurity program and strategy, including insights into emerging risks and industry trends. Moreover, the board benefits from supplementary educational briefings delivered by both internal and external experts, providing invaluable global threat visibility and enhancing the Board's understanding of cybersecurity challenges and opportunities.

companyName: EnerSys

ticker: ENS


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO's experience includes over twenty (20) years of design, implementation and management of cyber-security programs at various levels and organizations.

companyName: Viant Technology Inc.

ticker: DSP


text: The Audit Committee of the Board of Directors provides governance and oversight of the cybersecurity program and approves the information security program annually. Regular updates are presented to the Audit Committee by the CISO on the current state of the cybersecurity program, providing transparency including progress on initiatives, operational and compliance metrics, risks, cybersecurity and data privacy incidents (if any), and appropriate remediation actions. The Board of Directors also considers cybersecurity topics on an ad hoc basis where appropriate, including for purposes of receiving briefings on developments in cybersecurity or cybersecurity incidents and assessing and managing potentially material risks arising from cybersecurity threats. There are two committees comprised of Company leadership, including the enterprise risk management steering committee, which meets monthly, and the Xerox Holdings management audit committee, which meets at least quarterly, to discuss the current operational and security compliance metrics, cybersecurity incidents, and risks.

companyName: XEROX CORP


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity have also had discussions about various cybersecurity topics with a board member in response to requests.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: Oversight of Board of Directors The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities. The board of directors receives updates on the Company's cybersecurity risks and protective measures periodically. Cybersecurity matters are reported to the board of directors so that the board of directors can effectively carry out their oversight role.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs the ITSC and Board Risk Committee of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Security Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: Cybersecurity risks are integrated into TEC's overall risk management process through the collaboration of the cybersecurity professionals and TEC's and Emera's risk management functions to assess threat levels on an affiliate and corporate basis and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through receiving regular reports from the CIO, which include updates on TEC's performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to TEC, TEC's processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident. The CIO also provides regular updates on the key elements of its cybersecurity program to the Emera Board's Risk and Sustainability Committee, which has oversight over Emera's enterprise risk management framework, including oversight over cybersecurity risk.

companyName: TAMPA ELECTRIC CO


text: The Company has established clear criteria for determining the materiality of cybersecurity incidents, which include assessing potential or actual financial impacts, reputational damage, and operational disruptions. Documented incidents are meticulously recorded, detailing their nature, scope, and financial implications, ensuring transparency and accountability. The timeliness of Form 8-K filings following material cybersecurity incidents is strictly adhered to, with a thorough process in place for documenting any reasons for delayed disclosures. This ensures compliance with SEC requirements and maintains stakeholder confidence in the Company's cybersecurity posture.

companyName: T Stamp Inc

ticker: IDAI


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our Chief Information Officer (the "CIO") has primary oversight of material risks from cybersecurity threats. He has over 40 years of professional experience across various engineering, business and management roles. Directly reporting to our CIO is our Deputy Chief Information Officer ("the Deputy CIO"), with over 30 years of experience leading implementation of various IT infrastructure and systems, and our Chief Information Security Officer (the "CISO"), with over 20 years of specific cyber security experience and is responsible for maintaining compliance with applicable security requirements. The CIO and the CISO have a combined tenure of over 33 years with the Company in various progressive management roles in information systems and technology and information security.

companyName: ICF International, Inc.

ticker: ICFI


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Bridge Investment Group Holdings Inc.


text: As part of our cybersecurity risk management process, we: • Periodically review and implement procedures that endeavor to follow the cybersecurity standards set forth by the National Institute of Standards and Technology, including procedures with respect to evaluation and monitoring of cybersecurity threats and incidents; • Implement, maintain and regularly review incident response plans to manage cybersecurity threats and incidents and further improve our preparedness and response infrastructure. Such plans are informed by our testing and monitoring activities and set forth actions to be taken in responding to and recovering from cybersecurity incidents which include procedures for assessing the severity of such threats and incidents, escalating and disseminating information and containing, investigating and remediating threats and incidents; • Engage third-party security firms to monitor and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers, and conduct periodic penetration tests with the aim of identifying and remediating vulnerabilities; • Periodically evaluate and assess cybersecurity risks associated with our use of key third-party business partners, vendors and service providers. However, we do not control the cybersecurity plans and systems put in place by such third parties and we may have limited contractual protections with such third parties, such as indemnification obligations to us, which could cause us to be negatively impacted as a result; • Provide employees with the training, tools and resources designed to protect the Company from cybersecurity threats and incidents and to identify and report such threats and incidents. Our employees receive training and testing on cybersecurity protocols throughout the year, including regular anti-phishing campaigns, periodic live training programs and mandatory annual training and assessments with passing requirements. Each employee periodically acknowledges that they have read, understood and will abide by the Company's cybersecurity policies; and • Seek to minimize the amount of personal information collected to support business needs and use storage and transfer protocols leveraging encryption of critical information, including confidential or personal information.

companyName: Ventas, Inc.

ticker: VTR


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary. We regularly test and update these frameworks to ensure timely and accurate identification, resolution, and reporting of cybersecurity incidents.

companyName: PRICESMART INC

ticker: PSMT


text: The Senior Vice President of Systems and the Vice President of IT are responsible for assessing and managing material risks from cybersecurity threats through the implementation of the Company's information security policies and processes. The Senior Vice President of Systems has over 20 years in IT and cybersecurity experience with the Company. The Vice of President IT has over 15 years in IT and cybersecurity experience with the Company and has earned industry certifications in IT. The Senior Vice President of Systems and the Vice President of IT report to the Executive Vice President of Risk, Systems, and IT.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of IT, the Chief Executive Officer, and the Chief Financial Officer. Our Senior Director of IT has approximately 25 years of experience in IT and cybersecurity.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our information security program also evaluates potential risks associated with certain third-parties with whom we do business, especially our service providers that deal with sensitive employee, business, or customer data. This includes risk evaluation before choosing such vendors, periodic assessment thereafter and if a third-party has a reported cybersecurity incident, we perform an assessment to find and reduce risks related to such third-party incident that may affect us.

companyName: ARKO Corp.

ticker: ARKO


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Cybersecurity Manager and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Castellum, Inc.

ticker: CTM


text: Lightbridge utilizes third-party vendors to manage its Information Technology (IT) systems via a Managed Service Provider (MSP) for general administration of the IT process including providing a Virtual Chief Information Officer (vCIO).

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: The processes implemented by our IT leadership and IRT to oversee and identify cybersecurity risks are based on the Prologis Information Security Policy governed by the NIST Cybersecurity Framework. The framework focuses on five key categories of cybersecurity risk management and governance: (i) identify: develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) protect: develop and implement appropriate safeguards to ensure delivery of critical services; (iii) detect: develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) respond: develop and implement appropriate activities to take actions regarding a detected cybersecurity incident; and (v) recover: develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or service that were impaired due to a cybersecurity incident. This framework is utilized within our organization as part of an integrated risk management program that involves participation from employees, to our Board and third-party service providers, with whom we have protocols in place to mitigate cybersecurity incident risks within our supply chain through the products and services we provide and use. Additionally, all employees and contractors are required to attend mandatory cybersecurity training on an annual basis.

companyName: Prologis, Inc.

ticker: PLD


text: The underlying controls of our Program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Ms. Zhang is responsible for developing enterprise-wide cybersecurity strategy, architecture, policies, processes, and controls, and is directly responsible for our cybersecurity program.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2023, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and seventeen years as a corporate privacy and security officer.

companyName: NeuroPace Inc

ticker: NPCE


text: The director of information security is responsible for all aspects of cybersecurity across the company's locations and data centers, including security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management. He holds a Bachelor of Science in Business Administration, Management Information Systems from the University of Arizona, holds various certifications, and has served in various roles in information technology for over 25 years at numerous technology companies and consulting firms.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Our management, represented by our Chief Technology Officer, Greg C. Thomas, and our Chief Financial Officer and Treasurer, Marc E. Binda, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: Our cybersecurity risk management program is principally managed by our Global Information Systems team, which is led by our Chief Information and Security Officer, who reports directly to our Chief Executive Officer, as well as our Deputy Chief Information Security Officer (Deputy CISO). Our Chief Information and Security Officer and Deputy CISO combined have more than 40 years of experience in cybersecurity and/or information technology risk management, have relevant certification, and are active in a variety of cybersecurity related boards and organizations. Our Chief Information and Security Officer also serves as the officer who reports directly to senior management and makes regular reports to the Audit Committee and Board of Directors as described in this Item 1C. Under the direction of our Chief Information and Security Officer and Deputy CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and work to enhance our cybersecurity program as needed in response to such developments.

companyName: ACCURAY INC

ticker: ARAY


text: Material Impact of Cybersecurity Risks The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, or financial condition are regularly evaluated. During the reporting period, we did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, our business strategy, operational results, or financial condition. We further describe cybersecurity risks that we face in "The failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively" and "We, our Investment Adviser and our portfolio companies are subject to risks associated with cyber-attacks" under "Item 1A. Risk Factors" of this annual report on Form 10-K.

companyName: SLR Investment Corp.

ticker: SLRC


text: In the event of a cybersecurity incident, the IT Department promptly reports the matter to the Executive Committee, which consists of our senior leadership team. The Executive Committee is responsible for assessing the severity and potential impact of the incident and determining the appropriate course of action. The Executive Committee keeps the Board informed of significant cybersecurity incidents and provides updates on the overall status of our cybersecurity program as needed.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Based on the residual risk score of a third party, we conduct assessments on a periodic basis to help ensure that we maintain current, up-to-date information on our vendors. We leverage an external third-party monitoring service to conduct continuous monitoring of our critical vendors to provide additional visibility and response efforts and work directly with vendors to remediate identified vulnerabilities. Finally, we review contracts that outline risk management responsibilities, compliance requirements, data protection, and incident management protocols.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. Our Global Director of IT also provides periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee provides periodic reports to the board of directors on such matters.

companyName: Identiv, Inc.

ticker: INVE


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings "We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results" and "We may be subject to information technology failures that could damage our reputation, business operations and financial condition" included as part of our risk factors disclosures in "Risk Factors" above.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: Unresolved Staff Comments & Properties In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Partnership programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Additionally, we also think about data handling from a code and infrastructure level, incorporating encryption measures in transit and at rest to safeguard both internal and customer data. We further employ a proactive backup strategy, ensuring rapid system restoration in the event of disruptions. This measure minimizes downtime and underscores our commitment to business continuity and customer service reliability.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Company's Information Technology, Enterprise Security, Internal Audit, as well as the Legal and Privacy teams work closely to identify issues and incidents in a timely manner and report them to senior leadership, the Board of Directors, and regulatory bodies, as appropriate. Assessing, identifying, and managing cybersecurity risks are integrated into our overall enterprise risk management (ERM) framework that provides risk quantification, scenario analysis to determine the potential impact on the enterprise, and processes to manage risk within the parameters of the organization's risk appetite. Additionally, ERM provides support to the decision-making process to enable cybersecurity risk owners to accomplish the desired level of asset protection and alignment consistent with the organization's strategy. The ERM update is presented annually to the Audit Committee and Board of Directors, including the management of top risks and the review of emerging risks.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our Board of Directors.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: As of the date of this report, we are not aware of any material risks resulting from any previously reported cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. We discuss the risks relating to cybersecurity threats and their potential impact on our business more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: Vimeo, Inc.


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: CURIS INC

ticker: CRIS


text: Impact on the Company We have experienced, and may continue to experience, cyber incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. For further discussion, see Item 1A. "Risk Factors – Disruptions of our information technology systems could damage our reputation and materially disrupt our business operations " and Item 1A. "Risk Factors - We could be subject to reduced revenues, increased costs, liability claims, or harm to our competitive position as a result of data theft, cyberattacks or other security vulnerabilities."

companyName: INSPERITY, INC.

ticker: NSP


text: We also work with third parties that assist us in identifying, assessing, and managing cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing certain obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Our CISO, in coordination with our Executive Steering Committee, including our CEO, our Chief Financial Officer ("CFO"), our Executive Vice President, Engineering, our Director of IT and our General Counsel, works collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to provide governance over cybersecurity issues, address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our CISO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee, and in certain incidents to the Board, when appropriate.

companyName: PROS Holdings, Inc.


text: Independent cybersecurity testing is performed by outside parties on at least an annual basis to identify opportunities for cyber control strengthening in the face of applicable threats. The results of these evaluations are reviewed and prioritized by the CIO and CISO based on their applicability and urgency to address gaps and drive continuous improvement. These findings, along with resultant enhancement and remediation efforts, are communicated with the Company's Board of Directors.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: using a third-party cybersecurity oversight program maintaining oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Our Board believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. Our Board has delegated to its Governance Committee the responsibility for monitoring the effectiveness of the Company's internal cybersecurity program and coordinates its findings with the company Audit Committee. The VP of IT and various members of the Incident Response Team report on cybersecurity threats, incidents, plans and responses to the Governance Committee and/or the entire Board on at least a quarterly basis, and more often as needed.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Risk Management & Strategy Rocky Brands recognizes the critical importance of developing, implementing, and maintaining a robust information security program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established information security programs and policies, including processes for identifying, assessing, and managing risks arising from cybersecurity threats. These processes involve regular assessments of our information systems and infrastructure to identify vulnerabilities and threats. We focus on executing a centralized information technology and cybersecurity program. Our Company-wide approach is to be positioned as one security program, one posture and one roadmap for the enterprise. This platform is administered across our departments by our cybersecurity team led by our Senior Vice President of Information Technology. Our information security programs and policies are aligned with those of the Center for Internet Security (CIS), Control Objectives for Information Technologies (COBIT), and National Institute of Standards Technology (NIST).

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our policies over areas such as information security, access on/offboarding, and access and account management help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: We engage third-party industry cybersecurity experts to evaluate and review our cybersecurity programs. Our cybersecurity risk management program encompasses such items as simulations, drills, assessments, and tabletop exercises with management's participation and incorporates third-party industry cybersecurity experts and advisors as appropriate. These simulations, drills and assessments are conducted to test our defenses from both a technical and an operational perspective. In addition, all employees undergo security awareness training, with regular testing through simulated phishing emails. Certain employee positions require additional role-based, specialized security awareness or other cybersecurity training, as applicable. We also maintain a security operations center, which is staffed 24/7, to strengthen our monitoring and alerting efforts.

companyName: MASTEC INC

ticker: MTZ


text: Endpoint Protection – Littelfuse has implemented anti-virus, malware, and endpoint protection management detection and monitoring solutions on end-user devices and servers. Logs and alerts from these monitoring solutions are routed to independent third-party monitoring vendors that provide 24/7 monitoring, around the world.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels.

companyName: GXO Logistics, Inc.

ticker: GXO


text: In designing and evaluating our cybersecurity program, we intend to adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 will be for guidance purposes to frame our risk identification, assessment and management processes and will not equate to compliance with any specific technical standards or requirements.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our cyber-security risk strategy includes policies and procedures for assessing, identifying and managing material cybersecurity threats. Our program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks. Our cybersecurity posture is risk based, focused on the areas of higher risk to the company and associates. Our cybersecurity policies, standards and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the enterprise risks that are subject to oversight by the Board of Directors acting through the Audit Committee of the Board of Directors.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: TPG's chief information security officer leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing TPG's cybersecurity program. TPG's chief information security officer previously held various leadership roles within the technology risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: The foregoing responsibilities are covered on a day-to-day basis by our Chief Information Security Officer and their team. The department consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 20 years of cybersecurity experience, 12 of which was spent at the Company.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: We have an Information Security Steering Committee (the "ISSC"), comprised of members of our executive team, our Chief Information Officer, CSO, and Chief Legal Officer. Our CSO, in coordination with the ISSC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our SecOps team communicates with and reports to the CSO, enabling the CSO and the ISSC to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CSO has over 25 years of security experience in multiple technology disciplines, including prior work experience leading cybersecurity teams, technology strategies and security architecture. He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional ("CISSP") and a Certified Secure Software Lifecycle Professional ("CSSLP"), and holds Honors BSc degrees in Computer Science and Physics.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: Cybersecurity Risks As of December 31, 2023, we have not had any material cybersecurity incidents. However, we face risks associated with cybersecurity incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts or other scams. Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Internally, our cybersecurity initiatives are led by our Information Technology ("IT") team headed by our experienced IT Manager, who is a Microsoft Certified Professional and holds certifications in CompTIA Network+ and Cisco Networking. During 2024, we also onboarded a Director of IT Research & Development with over 15 years of experience in IT, systems development, and cybersecurity frameworks, including senior roles at Fortune 500 companies. Both these IT leaders play a key role in driving strategies and solutions for system protection and incident management.

companyName: Karat Packaging Inc.

ticker: KRT


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which i is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp II


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches, and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs, and negatively impact our reputation among customers and partners. Company is in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: We recognize the importance of cybersecurity risk management and have a defined strategy to support our business operations, platforms and information systems. We have implemented a comprehensive cybersecurity program to protect information systems and data. We have based our cybersecurity program on defined industry accepted frameworks with the goal of building enterprise resilience against an evolving cybersecurity threat landscape and to respond to cybersecurity threats as they materialize. Our program includes identification, assessment, monitoring, and management components, as well as informational and escalation components designed to inform management and the Board of prospective risks and developments.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our Board has charged the Corporate Risk and Sustainability Committee with assisting the Board with its oversight of cybersecurity risks, which is a component of our overall enterprise risk management program. The Corporate Risk and Sustainability Committee includes directors with cybersecurity experience and expertise, primarily through supervision of information technology departments as executive officers. The Corporate Risk and Sustainability Committee receives regular updates from senior management and our Chief Information Officer on cybersecurity risks, incidents and trends, and ongoing and planned projects. Regular status reports are also provided by the cybersecurity organization to our Chief Information Officer and other members of our senior management and incident updates are reported to senior management as the Chief Information Officer and cybersecurity organization considers appropriate depending on the severity of the incident.

companyName: WESTLAKE CORP

ticker: WLK


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.

companyName: Ayala Pharmaceuticals, Inc.

ticker: ADXS


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: ZRCN Inc.

ticker: ZRCN


text: The Audit Committee of the Board of Directors is charged with oversight of cybersecurity matters and receives regular reports from the CISO and the CIO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. In accordance with our cybersecurity incident response plan, the Audit Committee is promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. The Chair of the Audit Committee regularly briefs the full Board on these matters. In addition, the Board also periodically receives cybersecurity updates directly from management.

companyName: COCA COLA CO

ticker: KO


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items related to cybersecurity regularly throughout the year, including through periodic updates from the Chief Information Officer ("CIO").

companyName: STONERIDGE INC

ticker: SRI


text: Furthermore, the Chief Information Security Officer provides regular updates and presentations directly to the Board of Directors on cybersecurity matters. This direct line of communication ensures that the Board remains informed and engaged in understanding and managing cybersecurity risks facing the Company.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See Part I, Item 1A, "Risk Factors—Risks Related to Our Business—Cyber risk and the failure to maintain the availability or security of our systems or customer, colleague, or Company data could adversely affect our business, harm our reputation, and/or subject us to costs, fines, penalties, investigations, enforcement actions, or lawsuits."

companyName: Hyatt Hotels Corp

ticker: H


text: The Company has a designated Chief Information Security Officer (the "CISO"). The Program is implemented and managed by the Company's executive management under the leadership of the CISO. The Company contracts with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies. Additionally, the Company has retained a number of well-established and reputable cybersecurity consultants, including forensics experts, auditors, as well as outside cybersecurity legal counsel to assist with cybersecurity matters as needed from time to time.

companyName: MOLINA HEALTHCARE, INC.

ticker: MOH


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has certifications from various organizations, such as ISC2 (Certified Information Security Systems Professional or "CISSP"), Global Information Assurance ("GIAC"), and the EC-Council.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: Following these risk assessments, we adjust existing and implement new controls responsive to changes in the risk environment and maintain those controls to mitigate and minimize identified risks. This process includes reasonably addressing any identified gaps in existing safeguards and regularly monitoring the effectiveness of our controls over time. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Director of IT who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: Axonics, Inc.


text: This step creates the baseline security controls, depending on the infrastructure and data type. Different data types require different levels of security. Examples of information types may be health care data, banking information or client data. In addition to data types, how and where data is stored is also a consideration when developing security controls. We have applied recommended security controls to match system categorization. For us, our data would be classified as company confidential. We do not store protected health information, personal identifiable information, which is information which permits the identity of an individual to whom the information applies to be reasonably inferred, or client financial information. For storage and processing of data, we use third party storage. We have reviewed the security of the third party systems as well as the security of law firms that we retain to enforce our intellectual property rights, and we believe that they comply with our standards. However, we cannot assure you that the steps we have taken will be sufficient.

companyName: QUEST PATENT RESEARCH CORP

ticker: QPRC


text: In addition, Keysight maintains information security risk insurance to offset the costs of an information security breach. The policy is reviewed annually and updated as needed. We also engage with approved third-party companies that review our regulatory compliance, validate control performance, perform penetration testing and provide impartial risk assessments.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2022 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: KKR FS Income Trust


text: Our cybersecurity program is managed by our Vice President of Operations ("VP Operations") and our Director of Information Technology ("IT Director"), whose team ("Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our VP Operations and IT Director have experience with large information technology footprints, including cybersecurity. Their in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Audit Committee of our Board of Directors oversees management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Our current Chief Information Security Officer (CISO) has over 20 years of experience architecting and directing global information security functions and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. Our CISO is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO receives ongoing communication from relevant teams related to cybersecurity and is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.

companyName: OPEN TEXT CORP

ticker: OTEX


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We monitor cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that we use through third party providers that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: At the executive management and management levels, the chief information security officer leads the process of assessing and managing material risks from cybersecurity threats. Our chief information security officer has over 25 years of experience as a technology professional with in-depth knowledge of IT management processes and holds multiple degrees and professional designations, including as a certified information systems security professional (CISSP). The chief information security officer also works in collaboration with our chief information officer and chief risk officer and is supported by a cross-functional group of qualified and experienced professionals across various committees and functions. On a quarterly basis, the chief information officer provides a cybersecurity update to the disclosure committee and, on a monthly basis, the information security office team delivers a cybersecurity report to the senior executive team. Also refer to Item 10, Directors, Executive Officers and Corporate Governance, for additional qualification, experience and responsibility details.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) the oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: MPC engages with external resources to contribute to and provide independent evaluation of its cybersecurity practices, including a periodic assessment of its cybersecurity program that is performed by a third party. MPC's cybersecurity leadership and operational teams monitor cybersecurity threat intelligence and applicable cybersecurity regulatory requirements in a variety of ways, including by communicating with federal agencies, trade associations, service providers, and other miscellaneous third-party resources. MPLX GP's management team, through consultation with MPC's Senior Vice President and Chief Digital Officer ("CDO"), Vice President and Chief Information Security Officer ("CISO"), and the MPLX GP Audit Committee of the MPLX GP Board, use the information gathered from these sources to inform long-term cybersecurity investments and strategies which seek to identify cybersecurity threats and protect against, detect, respond to and recover from cybersecurity incidents.

companyName: MPLX LP

ticker: MPLX


text: Employee Training Our employees are required to take annual cyber and physical security training designed to help employees guard our cyber and physical data. Employees are tested regularly on cybersecurity, and cybersecurity performance is considered in annual employee performance reviews.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Management and Strategy rely on our management and third-party service providers to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity function is integrated within our broader risk management function that identifies, monitors, and mitigates strategic, operational, financial, and legal risks.

companyName: Strategic Environmental & Energy Resources, Inc.

ticker: SENR


text: Oversight of Third-Party Risk Trinity implements stringent processes to oversee and manage cybersecurity risks associated with its use of third-party service providers. These processes include targeted assessments of both third parties and the solutions being implemented or used in accordance with Trinity's information security policies, standards, and risk appetites. In addition, we seek contractual safeguards where appropriate regarding cybersecurity and information risk management.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a security incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors who have access to our critical systems and information; and • cybersecurity insurance to cover us for costs and expenses we may incur due to a cybersecurity incident.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: We also apply this same overall framework to our oversight and management of cybersecurity risk from service providers, vendors, suppliers, and other third parties. Our policies require due diligence on our service providers, vendors and suppliers prior to engagement and impose audit rights in our contracts in order to identify cybersecurity risks associated with third-party relationships, proportionate to the inherent risk associated with the products and services provided and the criticality and sensitivity of our information and technology assets to which the third party may have access. As noted in our risk factors in Item IA of this report, our third-party risk management framework may not be implemented effectively or may not be successful or sufficient to mitigate all of our risks. When we become aware that a service provider, vendor, supplier, or other third party has experienced any compromise or failure in the technology infrastructure owned or controlled by such third party, we may attempt to mitigate our risk, including by terminating such third party's connection to our information and technology assets where appropriate. We also regularly and proactively engage relevant vendors and other third parties to assess risk to Visa information assets when a new vulnerability or compromise is reported that may affect those third parties.

companyName: VISA INC.

ticker: V


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor evolving cybersecurity standards and emerging data protection laws and implement changes to our processes to comply;

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: The CIO has extensive technology work experience at S&P 100 companies overseeing and executing technology strategies in complex, global, highly matrixed environments. The CIO provides executive leadership on technology strategy, policy, and capabilities across the Abbott enterprise.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Cybersecurity risks and data protection are key components of our long-term strategy and enterprise risk management program and are integrated into our overall risk management systems and processes. We maintain processes for assessing, identifying and managing material risks from cybersecurity threats, and we routinely invest in the development and implementation of essential cybersecurity systems, infrastructures and processes to protect the security and integrity of our systems, networks, databases and proprietary information. Key areas of our cybersecurity risk management processes and strategy currently include:

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Engagement of Third Parties in Connection with Cybersecurity Processes. We regularly engage various third parties to assess, test, or assist with the implementation of our cybersecurity processes. We engage independent third parties to conduct risk assessments, penetration tests, vulnerability scans, and tabletop exercises. Although our internal audit department is responsible for auditing our cybersecurity programs, we also engage an independent, external firm with expertise in information security to conduct annual audits of our cybersecurity program.

companyName: PACIFIC PREMIER BANCORP INC


text: At the executive and management level, the CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program. The CIO has 20 years of experience in technology risk management, 12 of which have been with the Company (or its affiliates). In addition to the CIO, the Company's information security team under the direction of the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Information security processes include escalation of certain risks and incidents to the CIO and the executive team and quarterly dashboards also used to update the risk landscape.

companyName: Uniti Group LLC


text: Our Director of IT, who has extensive cybersecurity knowledge and skills gained from over 10 years of work experience in various information technology roles, heads the team responsible for implementing and maintaining cybersecurity and data protection practices and reports directly to the Chief Financial Officer.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: Cleco's CSIRP helps ensure a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting Cleco. This response plan includes detection, analysis, containment, eradication, recovery, post-incident review, and timely notice to relevant stakeholders, including Cleco's Audit Committee, once an incident is deemed to be potentially impactful or material.

companyName: Cleco Corporate Holdings LLC


text: The Company continuously seeks to identify threats, vulnerabilities, and cybersecurity risks on information assets. Threats are identified through experience, regulatory alerts, information sharing, third party vendors, internal and external security assessments, and industry periodicals.

companyName: BANCFIRST CORP /OK/

ticker: BANF


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: SELECTIS HEALTH, INC.

ticker: GBCS


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Our board of directors is actively involved in oversight of our Company's risk management, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the Committee of Sponsoring Organizations of the Treadway Commission 2013 Framework. In general, our Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.

companyName: STORE CAPITAL LLC


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - We are subject to cybersecurity and information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in technology used to manage operations and other business processes. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Despite the Company's security measures and programs, our information technology and infrastructure are susceptible to cybersecurity incidents, intrusions and attacks, any of which could have a materially adverse effect on our business, operating margins, revenues and competitive position. See "Part I—Item 1A. Risk Factors" for further discussion of these risks.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: Our management team, including the VP IT, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team has experience with implementing IT organizational policies and procedures, working in multiple platform environments, and overseeing corporate networking and hardware framework.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: MPC's CISO is responsible for the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Operations & Engineering, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing.

companyName: MPLX LP


text: Our Chief Operating Officer leads our cybersecurity program and reports, with respect to cybersecurity incidents, to the Company's Chief Financial Officer. Our Chief Financial Officer reports directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversight, including cybersecurity risks. The Chief Financial Officer briefs the Board and Audit Committee on the effectiveness of our cybersecurity program quarterly. We have not experienced any cybersecurity threats or incidents that have had a material impact on our business to date.

companyName: FEMASYS INC

ticker: FEMY


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full board of directors. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief security officer on the Company's latest information security risks and mitigation strategies.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external security support providers, including cybersecurity consultants, in evaluating, monitoring, and testing our cyber management systems and related cyber risks. The Company's collaboration with these third parties includes threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: We also have conducted a cyber breach simulation exercise with the assistance of a third party cybersecurity consultant. The exercise focused on incident management and communication processes. Company business functions, executive management and members of the Board participated. The goal was to identify opportunities for greater efficiency, coordination, and alignment.

companyName: Civeo Corp

ticker: CVEO


text: We maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, strategic or competitive in nature, and proprietary or confidential information, including clinical trial data, personal and financial information ("Information Systems and Data").

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS