text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: Additionally, Amedisys performs periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluates our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity threats or personal data breaches.

companyName: AMEDISYS INC

secItem: Item 1C


text: There can be no assurances that our cybersecurity risk management program, including policies, controls, or procedures will be effective in preventing successful attacks on our information technology infrastructure or digital assets, or that the limits of our cybersecurity policy will be sufficient to cover losses which could be incurred in a successful attack.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, access controls, employee training, penetration testing, and systems monitoring.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Monitoring and Mitigation In addition to the ongoing cybersecurity program management carried out by the Senior Director of Information Security, the Company also has the Buckle Incident Response Team ("BIRT"), a cross-functional group with relevant expertise and authority to support all aspects of the incident response, recovery, and reporting of a security incident. BIRT uses a well-defined incident response plan that outlines processes to prepare for and detect cybersecurity threats, analyze the severity, materiality, and impacts, determine who should be notified and involved in the Company's response, and define actions necessary to contain and recover in the event of an incident. As part of this process, cybersecurity incidents surpassing a certain level of severity necessitate communications to the Board of Directors. On an annual basis, the Company performs tabletop exercises designed to enhance BIRT's readiness and effectiveness in handling cybersecurity incidents.

companyName: BUCKLE INC

ticker: BKE


text: The Executive Director of IT and Chief Financial Officer, or CFO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key cybersecurity priorities to relevant personnel. The Executive Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: While we focus on prevention and detection, we also have incident response and recovery plans in place designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. In the event of a cybersecurity incident, our incident response process involves assessing incident severity, conducting root cause analysis, creating and implementing plans to address the incident, mobilizing appropriate resources and identifying potential remedial measures and other appropriate next steps. We also have on retainer a third-party consultant to assist us in our incident response and remediation.

companyName: TD SYNNEX CORP

ticker: SNX


text: Processes and Coordination We manage cyber security and assess associated risks in these ways: • ITSS, led by our Chief Information Security Officer (CISO), has first-line responsibility for our cybersecurity risk management processes, and works to coordinate efforts, priorities and oversight of cybersecurity risk; • ITSS works with functional groups such as manufacturing, business operations, engineering, human resources, legal, and finance and is responsible for evaluating and assessing overall cybersecurity risk, and advising senior management and the Audit Committee regarding our cybersecurity risk profile and priorities as they evolve • we have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes; and • our Internal Audit group monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified will be assessed to identify the range of possible outcomes and risks will be prioritized by their level of importance. Each risk will be assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Reviews are performed by the Company's internal audit team to assess the effectiveness of IT internal controls and compliance with regulatory policies and cybersecurity best practices, and any identified weaknesses are promptly addressed.

companyName: DallasNews Corp


text: Our enterprise-wide information security program is designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Cybersecurity risks related to our business, network, and operations are identified and addressed through a multi-faceted approach including third party assessments, as well as internal information system and network security, governance, risk and compliance reviews.

companyName: Bandwidth Inc.

ticker: BAND


text: We are also committed to strong third party risk management. Our Third Party Program provides regulatory guidance for managing third party risk and is designed to assist us with the identification, measurement, management, monitoring and reporting of third party risk.

companyName: Discover Financial Services


text: Our security steering team is responsible for assessing and maintaining our cybersecurity risk program and engages third-party cybersecurity experts for risk assessment and system enhancements. In addition, we provide training to all employees both during the initial onboarding process and on an annual basis. We also conduct tabletop exercises to assess our cybersecurity readiness on an annual basis.

companyName: PRECIGEN, INC.

ticker: PGEN


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Directors for approval..

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. Our cybersecurity program is overseen by our Chief Information Officer ("CIO "), who has more than 20 years of experience in information technology. This program incorporates policies, processes, and activities over domains such as access control; facility and data protection; IT systems and data transmission security; threat intelligence and incident response; third-party risk management; disaster recovery; and vulnerability management. We have a comprehensive cybersecurity policy in place that includes robust measures to protect our data and systems from cyber threats, ensuring the integrity and confidentiality of our information.

companyName: Quanterix Corp

ticker: QTRX


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or participants in our clinical trials, and violation of data privacy or security laws.

companyName: Karuna Therapeutics, Inc.


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits. • Incident Response and Recovery Planning: We have established and maintain an incident response plan and a business continuity and disaster recovery plan designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity. The individual currently operating as our vCISO has over 15 years of experience in providing services as an enterprise vCISO across various industries, including life sciences and national defense and has advised various agencies of the U.S. federal government.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Our CISO, who reports to the Chief Executive Officer, leads our information security team and has management responsibility for overseeing FedEx's cybersecurity program, including assessing and managing material risks from cybersecurity threats. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.

companyName: FEDEX CORP

ticker: FDX


text: Regular assessments are conducted to identify potential cybersecurity risks across our organization, ensuring a comprehensive understanding of our risk exposure. To support our capabilities, we engage assessors, consultants, auditors, and other third parties with specialized expertise in cybersecurity. Their assessments cover various aspects of our infrastructure, including penetration testing, vulnerability assessments, and compliance audits, enabling us to strengthen our defenses against current and emerging threats. We also conduct regular company-wide security awareness training and phishing exercises to help our employees stay vigilant against evolving cyber threats. This training is updated at least annually and includes targeted education for higher-risk roles to ensure employees adhere to best practices.

companyName: Altus Power, Inc.


text: We have implemented a robust vendor risk management program, which is designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers in response to questionnaires and meetings as well as information from third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities, and investigate security incidents that have impacted our third-party providers, as appropriate. We also obtain and review Systems and Organization Control ("SOC") reports from several of our key service providers.

companyName: BTCS Inc.

ticker: BTCS


text: We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for regular penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Solid Power, Inc.

ticker: SLDP


text: Our cybersecurity risk management program, which includes data privacy, product security, and information security, is designed to align with our industry's best practices. Our program provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing management and the audit committee of our Board of Directors (the "Audit Committee") of material cybersecurity threats and incidents.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: The vendors we retain are also categorized by the level of risk that the vendor presents to us, of which information security risk is a component. The information security team annually reviews those vendors in the "high risk" category and periodically reviews other vendors. This review includes obtaining updated information security audits and service organization reports, where available, and otherwise analyzing whether the vendor's cybersecurity risk profile has materially changed.

companyName: RENASANT CORP

ticker: RNST


text: The Company's Board of Directors has visibility into cybersecurity risks through its Audit Committee and through the process described below. The Audit Committee has oversight of the Company's cybersecurity risk management programs and the design and operating effectiveness thereof, and reviews reports from Company management on cybersecurity, data privacy and other risks relevant to the Company's computerized information system controls and security.

companyName: CODEXIS, INC.

ticker: CDXS


text: While our Board of Directors has overall responsibility for risk oversight, the Audit Committee of our Board of Directors (the "Audit Committee") is responsible for overseeing our cybersecurity risk management and strategy. The Audit Committee reviews and discusses with management and the Company's auditors, as appropriate, our risks relating to data privacy, technology, and information security, including cybersecurity and back-up of information systems. The Audit Committee also confers with management and our auditors, as appropriate, regarding the adequacy and effectiveness of our policies and the internal controls regarding information security.

companyName: Invivyd, Inc.

ticker: IVVD


text: We seek to improve the entire cybersecurity ecosystem through multistakeholder diplomacy to set and uphold expectations for state behavior, advancement of government policy that strengthens cybersecurity and resiliency, disruption and deterrence of cybercrime, protection of national security interests, and disruption of digital threats to democracies. We also establish processes and innovate solutions for us and our customers to address the growing number and complexity of cybersecurity regulations.

companyName: MICROSOFT CORP

ticker: MSFT


text: cybersecurity awareness training for our employees, incident response personnel and senior management; and a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.

companyName: CORNING INC /NY

ticker: GLW


text: Our information security procedures are overseen by our Chief Information Security Officer, supported by our Chief Technology Officer and our IT Manager, who are responsible to provide regular reports to our Chief Executive Officer and Chief Financial Officer as well as the technology and social responsibility committee and the governance committee of our Board. These procedures are responsible for identifying, assessing, and managing cybersecurity threats and risks and work to monitor and evaluate our threat environment and risk profile using various methods. These methods include evaluating our and our industry's risk profile, coordinating with law enforcement concerning select threats, and engaging with third parties to conduct external audits and threat assessments for certain systems.

companyName: Rekor Systems, Inc.

ticker: REKR


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program the CESC (as defined below) including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Although as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties.

companyName: Lionheart Holdings

ticker: CUB


text: Although we have purchased broad form cyber insurance coverage and believe that our cybersecurity protection systems are adequate, cybersecurity risk has increased due to remote access, remote work conditions, and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, information technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers. We cannot be certain that the attacker's capabilities will not compromise our technology protecting information systems, including those resulting from ransomware attached to our industrial control systems. If these systems are interrupted or damaged by any incident or fail for any extended period of time, then our results of operations could be adversely affected. We may incur remediation costs, increased cybersecurity protection costs, ransom payments, lost revenues resulting from unauthorized use of proprietary information, litigation and legal costs, increased insurance premiums, reputational damage, damage to our competitiveness, and negative impact on our stock price and long-term shareholder value. For more information regarding cybersecurity risks, refer to Information Technology and Cybersecurity Risk Factors on page 24.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: In addition, we have established an Information Security Awareness Program focused of several areas: • Formal training on topics such as phishing each month; • During Cyber Security Awareness month we provide additional training on topics like IT Policy, access management, and effective password management; • Company-wide informal training through lunch & learn sessions and department meetings; • Tabletop exercises with key personnel during which we simulate cybersecurity threats to test our capabilities and continually improve our response protocols.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: Risks from Cybersecurity Threats As of December 31, 2023 and as of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or nancial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.

companyName: HERBALIFE LTD.

ticker: HLF


text: We have a written information security incident response plan (the "Incident Response Plan") that we use to assist in our response to cybersecurity incidents. The Incident Response Plan provides a framework and process for our Incident Response Team. While our Incident Response Team identifies our initial response to potential or actual cybersecurity incidents, the Executive Response Team oversees the actions and recommendations of the Incident Response Team in connection with specific cybersecurity events. In addition, we have various processes to escalate matters based upon the threat level severity. The Incident Response Team and Executive Response Team (i) make ongoing assessments of the severity of incidents, (ii) escalate these matters based upon the severity of the threat level, (iii) depending on the level of severity of an incident, also involve our Chief Executive Officer or Audit Committee and Board of Directors in assessing specific cybersecurity incidents, (iv) determine the appropriate level of response to specific incidents taking into account the nature of the incident, and (v) take overall responsibility for leading and coordinating response efforts, involving additional response team participants and retaining third-party assistance, including legal counsel and other third-party cybersecurity experts, and assessing materiality of an incident.

companyName: RH

ticker: RH


text: The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Our CISO has numerous years of experience at PayPal and other organizations building security products, managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: As a result, at least in part, of the steps taken by the Firm with respect to our cybersecurity program, to our knowledge, we have not experienced a material breach to date. While all organizations are inherently at risk of cybersecurity threats, we do not believe that cybersecurity threats have affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we routinely face risks of cybersecurity incidents, wholly or partially beyond our control, and there can be no assurance that the security efforts and measures of the Firm and third-party providers will prevent incidents that could adversely affect the Firm's business. Refer to "Risk Factors Risks Related to Cybersecurity and Technology" in Item 1A. Risk Factors of this report for a discussion of risks from cybersecurity threats that could have a material adverse effect on our business, financial condition and results of operations.

companyName: KFORCE INC

ticker: KFRC


text: Management is responsible for the day-to-day handling of risks facing the Company, while the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee.

companyName: GENESCO INC

ticker: GCO


text: We have a dedicated information security organization, led by our CISO and overseen by our Chief Information Officer, which is responsible for assessing and managing material risks from cybersecurity threats. Our Chief Information Officer reports to our Group President, Growth and Strategy, a member of our senior leadership team who reports to our Chairman of the Board, President and Chief Executive Officer.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Busey relies extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business, as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see " Item 1A. Risk Factors—Operational Risks."

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Through appropriate risk evaluation, security assessments, and financial due diligence, we seek to protect the security and confidentiality of information provided to our vendors under service provider cloud computing or other arrangements. We also employ contractual nondisclosure requirements and use limitations consistent with our published Privacy Policy, and typically reserve the right to review third-party compliance against the required standards, where we deem appropriate.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: violation of privacy laws and other litigation and legal risk; and reputational risk. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our clients' information and prevent data loss and other security breaches, including a cybersecurity risk assessment program. Both management and the Board of Directors are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Global AI, Inc.

ticker: GLAI


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers.

companyName: GXO Logistics, Inc.

ticker: GXO


text: Our CISO and our Security Steering Committee, which includes members from management across all company functions such as security, IT, human resources, sales and marketing, engineering, legal, and finance, are primarily responsible for assessing and managing cybersecurity threats. Our CISO is a cybersecurity industry expert with over two decades of experience in cybersecurity, including work at multi-national technology companies and for a U.S. state government. He holds several industry certifications including CISSP, OSCP, CCSP, and GCFA and is also a graduate of the Carnegie Mellon University's Chief Information Security Officer Executive Program. Our CEO is also a cybersecurity industry expert who has deep insight and over two decades of experience in cybersecurity, technology and information security.

companyName: QUALYS, INC.

ticker: QLYS


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our Vice President and Chief Information Officer. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Audit Committee or the Board of Directors or investors through a relevant public filing.

companyName: Permian Resources Corp

ticker: PR


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Business Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 19 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Business Manager's management, and our Board and Audit Committee, as appropriate.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services.

companyName: Immunocore Holdings plc

ticker: IMCR


text: The Company maintains a formal and comprehensive enterprise-wide Information Security and Cybersecurity Program (the "Information Security Program") that protects the confidentiality, integrity, and availability of the Company's information assets and to manage reasonably foreseeable cybersecurity risks and threats. The Information Security Program includes a threat intelligence program, policies and procedures, multi-layered cybersecurity technical safeguards, third-party security risk assessments, a formal incident response program, mandatory trainings for employees and independent contractors upon hire and regularly thereafter, compliance to banking regulations, annual audits, and reviews of vendors who handle sensitive information.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery.

companyName: TABLE TRAC INC

ticker: TBTC


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27001:2022 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: The Chief Financial Officer oversees the operation of our cybersecurity program and has 10 years of executive experience overseeing risk management and internal controls. The Chief Financial Officer is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Chief Financial Officer's oversight of the Company's information technology function and supervision of the Company's IT administrator.

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: In October 2020, the Board created the Innovation and Technology Committee to aid the Board in its duties to assess and oversee the management of risks in the areas of information technology, information and data security, cybersecurity, disaster recovery, data privacy and business continuity. This committee oversees the GRC Committee's activities relating to information technology and cybersecurity matters, and seeks to enhance communication and coordination of efforts between the Board and management in these areas. The members of the Innovation and Technology Committee monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management process described below, including the operation of our incident response plan.

companyName: TruBridge, Inc.

ticker: TBRG


text: Data Inc. has not encountered any cybersecurity risks or incidents that have materially impacted our business strategy, operational results, or financial condition. We remain dedicated to maintaining a strong cybersecurity posture by continually analyzing and improving our security procedures to reduce potential risks. This approach to cybersecurity is critical for protecting sensitive information and guaranteeing the reliability of our business operations.

companyName: Vertical Data Inc.

ticker: VDTA


text: Board of Directors The Board's oversight of cybersecurity risk management is led by the Audit Committee which interacts with our CFO, who has oversight for information technology and our CCO, as well as other members of management. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the board of directors, through the Audit Committee, discuss our approach to cybersecurity risk management with the CFO and CCO.

companyName: ALIMERA SCIENCES INC


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT controls, governance, risk and compliance reviews.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: O ur cybersecurity governance program is led by our Vice President of Information Technology ("VP of IT"). The VP of IT is informed about and monitors the prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the security team. Our VP of IT has been assessing and managing cybersecurity risk for the Company since 2015. In total, our VP of IT has over 20 years of IT industry experience in various roles. Our cybersecurity security team includes a dedicated manager with over 15 years of experience, that reports directly to our VP of IT, to help manage cybersecurity risks for the Company.

companyName: Titan Machinery Inc.

ticker: TITN


text: Our cybersecurity risk management program includes: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including third -party network security reviews, scans, and audits, on at least an annual basis;

companyName: FOOT LOCKER, INC.


text: ITEM 2. PROPERTIES. GE Vernova is headquartered in Cambridge, Massachusetts and occupies approximately 600 sites in 465 cities and 95 countries. Approximately 85% of the sites are leased and 15% are owned. GE Vernova periodically reviews the portfolio of facilities for opportunities to optimize and best align our footprint needs.

companyName: GE Vernova Inc.

ticker: GEV


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes, which we rely on information technology systems and networks managed and maintained by independent third parties. Our information technology personnel, responsible for cyber security, monitors daily and weekly backups of our system to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our data is accessible by our assigned personnel and third parties as necessary and appropriate, to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our third party systems to submit relevant data to our IND.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: The Executive Officers and Executive Vice President, Corporate Services are involved in all significant and appropriate cybersecurity decisions on the implementation and design of our IT architecture. Executive Vice President, Corporate Services, along with support from the Director of IT, is responsible for the assessment and management of risks from cybersecurity threats and oversees the implementation of IT processes, which includes cybersecurity, into the core business of the Company. The Director of IT has extensive cybersecurity knowledge and skills gained from over 20 years of relevant work experience. The Director of IT discusses all potential changes to the Company's controls or detection systems with the Executive Vice President, Corporate Services prior to implementation. The Executive Vice President, Corporate Services is updated by the Director of IT on a periodic basis regarding trends in technology and cybersecurity threats or any potential changes to the Company's cybersecurity program. The Director of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through a number of experienced direction systems and third party cybersecurity providers. The Executive Vice President, Corporate Services also attends certain meetings of the Audit Committee to report information on material risks from cybersecurity threats. None of our critical core business activities that impact production, transportation or sales of oil and gas are remotely controlled.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Brighthouse Financial enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity risk management program, which is managed at an enterprise level, is designed to be aligned with the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"), which provides standards, guidelines and best practices on managing cybersecurity risk, as well as the organization, improvement and assessment of Brighthouse Financial's cybersecurity risk management program.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Program Adjustments The ISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: In the three-year period ended March 31, 2025, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior cybersecurity incidents experienced by either us or third parties, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: We have also incorporated security practices into employee trainings. We have a process for employees to formally acknowledge their review and understanding of security obligations. Additionally, our security and controls team conducts periodic security and data protection training aimed to emphasize the importance of security and data protection. We have also implemented a review process to assess the security profile and data protection practices of certain third-party suppliers and service providers that have exposure to our systems, including, as appropriate, review of vendor security policies and procedures. We do not, however, review security profile and data protection practices of all third-party vendors.

companyName: Symbotic Inc.

ticker: SYM


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: The Company's Board of Directors is responsible for regular oversight of the Company's overall risk management process. The Board reviews the most significant risks the Company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the Board of Directors.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: The Company's Global Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified Information Security Manager and Certified Information Systems Security Professional certifications from ISACA and ISC2, respectively, two leading independent cybersecurity associations.

companyName: Primo Water Corp /CN/


text: There have not been any breaches at the Sponsor or the Trust during the year ended June 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Bitcoin Cash Trust (BCH)

ticker: BCHG


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 11—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Corpus Christi Holdings, LLC


text: The senior executives work to protect our information systems from cybersecurity threats and to promptly assist in coordinating a response to any cybersecurity incidents in accordance with our cybersecurity incident response and recovery plans.

companyName: Anixa Biosciences Inc

ticker: ANIX


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are subject to oversight by the Company's Board of Directors. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; and (iv) maintaining the confidence of our customers, clients and business partners.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Role of Management Management is directly involved in assessing and managing PNC's risks from cybersecurity threats. PNC uses a three-lines-of-defense model where cybersecurity risk is managed and assessed by the first line of defense, led by the Chief Information Security Officer and the Director of Technology and Security Risk Management, and the second line of defense which is led by the Chief Technology Risk Officer, who reports to the Chief Risk Officer. The first and second lines of defense are examined internally by our third line of defense, Internal Audit. The lines of defense model ensures appropriate oversight within the management structure. See the Risk Governance and Oversight section of Risk Management for more details on each of our lines of defense. In addition to the three lines of internal defense, PNC engages external consultants to assess and inform the program, as needed.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed to align with industry standards and incorporates best practices such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: eHealth's Board of Directors oversees our enterprise risk management process, including cybersecurity, information security, governance, risk management, and compliance programs and strategies. The Board is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the risks that we face. The Board administers its cybersecurity risk oversight both directly and through its Audit Committee. The Audit Committee is regularly briefed on eHealth's risk profile issues. These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management's risk mitigation strategies. Management briefs the Audit Committee periodically about eHealth's protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.

companyName: eHealth, Inc.

ticker: EHTH


text: As a result of the transition of our business, limited employees and our lack of capital, we do not have any processes for assessing, identifying, and managing material risks from cybersecurity threats. Accordingly, we do not have any such processes that have been integrated into our overall risk management system or processes. Additionally we do not engage assessors, consultants, auditors, or other third parties in connection with any such processes, nor do we have processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider.

companyName: Legacy Education Alliance, Inc.

ticker: LEAI


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management and either the Board or the Audit Committee. The Company's Chief Information Security Officer ("CISO") has over 29 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security, Identity Governance Administration and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ several tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."

companyName: CALIX, INC

ticker: CALX


text: The information security team monitors security alerts from information security research sources and peer networking, and we have implemented processes and technologies for monitoring our networks for exfiltration of sensitive company information. Before contracting with third parties or purchasing third party technology or other solutions that involve exposure to sensitive company information the team assesses vendor risk, including by requesting SOC2 reports and/or security documentation from a vendor, where appropriate, and we receive and review security updates and alerts from these third parties. Penetration testing is performed periodically across our network boundaries to identify issues for remediation. Additionally, we maintain off-site back-ups and disaster recovery plans to restore our information and systems in the event of a disruptive event.

companyName: Blueprint Medicines Corp


text: Our Vice President, IT also coordinates with our CEO, CFO and General Counsel to determine strategic cybersecurity priorities and to establish compliance procedures.

companyName: Celcuity Inc.

ticker: CELC


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage, and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, their Audit Committee or their Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior members of Blue Owl's management, their Audit Committee or their Board of Directors, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: Blue Owl Real Estate Net Lease Trust


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of the data we use in our business, as well as our employee and clinical data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.

companyName: CONTINENTAL RESOURCES, INC


text: When a threat or other issue is identified, the information security team follows an incident response plan that outlines the process for investigating and addressing the issue. The incident response plan is focused on prompt interdisciplinary communication and coordination between the information security team and key members of the finance, legal, and communication teams, as well as senior management. The information security team also utilizes specific runbooks for various types of threats that are updated and expanded based on lessons learned and emerging best practices. Our incident response plan also provides for consideration of whether an incident is material, requiring disclosure to shareholders in SEC filings. Our team also has a disaster recovery plan, under which recovery testing occurs annually.

companyName: Weatherford International plc

ticker: WFRD


text: No Material Incidents. Since inception in January 2018, we have not experienced any material cybersecurity or information security incidents. We have not incurred any expenses due to material information security incident penalties or settlements.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The Company's Information Security team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: Enterprise Risk Committee Members of the Enterprise Risk Committee include senior leaders throughout the company, i ncluding our Chief Risk Officer (who chairs the Committee and is the head of our Enterprise Risk Management division), Chief Executive Officer, Chief Financial Officer, General Counsel, Head of Multifamily Business, Head of Single-Family Business, and Chief Information Office r. In addition, our Chief Audit Executive is a non-voting member of the Enterprise Risk Committee. As of December 2023, more than half of the members of the Enterprise Risk Committee had prior work experience in cybersecurity or other knowledge, skills or background in cybersecurity.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Cybersecurity Incident Impact While we identified no cybersecurity incidents, we have been subject to attempted cybersecurity threats and will likely continue to be subject to such attempts in the future. For additional discussions of risks from cybersecurity threats we face, see Item 1A "Risk Factors". There were no material cybersecurity incidents in 2023.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee oversees risks arising from our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: The Company's information technology team is primarily responsible to manage the Company's information systems and assess and address all cybersecurity events that are internally detected or externally reported. Communication among Company personnel, including members of upper management when appropriate, is a high priority. An escalation process is in place under the Incident Response Plan to manage cybersecurity events depending on the severity of the risk of information system exploitation. Incidents of critical severity require immediate notice to members of an oversight committee comprised of upper executive and information technology officers, a member of the Audit Committee, and corporate counsel for evaluation and appropriate response. Incidents of medium or low severity are assigned to the appropriate personnel for response, mitigation and remediation.

companyName: SIGMATRON INTERNATIONAL INC


text: The Audit and Risk Committee (the "ARC") has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The ARC reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration. Management regularly discusses cyber risks and trends and, should they arise, any material incidents with the ARC. Members of management overseeing cybersecurity threats, including our Chief Digital Officer and Chief Information Security Officer have experience in areas including management of information technology, data security, and cybersecurity.

companyName: T1 Energy Inc.

ticker: TE


text: Our CISO, who reports to our Executive Vice President and Chief Technology Officer, has 30 years of cybersecurity, risk and technology experience across the financial services, banking and insurance industries. She maintains both Certified Enterprise Risk Professional (CERP) and Certified Information Systems Auditor (CISA) certifications. She serves on CyberOhio as an advisor to the State of Ohio and is active as a Board member at Ohio University Grid Computing and Emerging Technologies program. She is an active member in several CISO forums. Each of our CRO (who reports to our Chief Executive Officer) and CORO (who reports to our CRO) has over 25 years of financial services experience in operations and risk management.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Our board of directors has delegated oversight of cybersecurity to the risk oversight and sustainability committee. The risk oversight and sustainability committee receives quarterly updates from management and provides feedback regarding cybersecurity, including updates regarding recent incidents in the industry and the cyber threat landscape, and is notified between such updates regarding significant new cybersecurity threats or incidents as necessary. The board of directors receives regular reports from the risk oversight and sustainability committee.

companyName: KADANT INC

ticker: KAI


text: Proactively review threat intelligence and other information obtained from governmental, public or private sources Perform network vulnerability scans, cyber-hygiene assessments, and continually evaluate and address perceived gaps. Conduct companywide cyber awareness training and on-going new employee cyber training. Deploy a wide array of industry leading 3rd party solutions to continuously monitor network and endpoints. On-going testing and evaluation of backup processes. Perform disaster recovery tabletop exercises to assess readiness for possible events.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we leverage the expertise of a managed service provider, and when warranted will engage with independent third parties in evaluating and testing our risk management systems. These service providers enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies meet generally accepted industry best practices. Our Chief Information Officer also performs ongoing review of current practices to further ensure cybersecurity.

companyName: Stran & Company, Inc.

ticker: SWAG


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber and Physical Security organizations, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: In addition, Ferguson regularly engages with independent third-party partners, including cybersecurity assessors, consultants, and auditors, to assess and consult on our cybersecurity capabilities, prioritize areas of risk and assist with execution of our risk management systems and strategic plans. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. To mitigate data or security incidents that may originate from third-party suppliers, we have a third-party risk management program that works to classify service provider or business partner risk based on several factors, including but not limited to data type accessed and/or retained. Using a risk-based approach, we perform diligence and security risk assessments for certain vendors and service providers, including appropriate obligations in our contractual arrangements where applicable.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, including information systems, we and third parties may be subject to attacks on or security breaches in systems or infrastructure we utilize which could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: Athena Technology Acquisition Corp. II

ticker: ATEK


text: Our cybersecurity controls also follow defense in depth principles, which aim to implement various layered access control, detection, prevention, and response measures. We periodically engage with third parties to assess our vulnerabilities and help us mitigate cybersecurity-related risks.

companyName: VISTA GOLD CORP

ticker: VGZ


text: The audit committee of the board of directors receives periodic reports from our Senior Director, IT & Facilities and third-party experts concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: CERUS CORP

ticker: CERS


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to senior management depending on the circumstances, including the chief executive officer and chief financial officer, who collaborate with the incident response team to mitigate and remediate such incidents. In the event of a significant cybersecurity incident the Board is also informed as part of our incident response plan.

companyName: Avid Bioservices, Inc.


text: We conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: The Information Technology Steering Committee (the "IT Steering Committee") meets at least quarterly and is composed of sixteen members of management, including the CDO, the CRO and the CISO. The IT Steering Committee oversees information technology matters at the Company, including the implementation of all cybersecurity policies, standards, guidelines and procedures. The responsibilities of the IT Steering Committee include, among other things, updating the Company's information technology policies, reviewing the architecture of the Company's information system infrastructure and monitoring the progress of any significant hardware or software updates or installation. In addition, the IT Steering Committee provides quarterly reports to the Board of Directors regarding any information-technology-related matters that, in the opinion of the IT Steering Committee, should be brought to the attention of the Board of Directors of the Company.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: As part of the above processes, we engage, as necessary, consultants and other third parties, to review our cybersecurity incidents if material to help quantify the impact and identify areas for continued focus, improvement, and compliance.

companyName: Azenta, Inc.

ticker: AZTA


text: Use of Third Parties We have engaged, and intend to continue to engage, nationally recognized third parties to assist us in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.

companyName: Simply Good Foods Co

ticker: SMPL


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of a cybersecurity incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.

companyName: TECOGEN INC.

ticker: TGEN


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled "We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents, could harm our ability to operate our business effectively."

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CIO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CIO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Board of Directors plays a crucial role, annually reviewing and approving our Information Security Program. The Board oversees efforts to develop, implement, and maintain an effective Information Security Program, including reviewing Management's reporting on program effectiveness. The Board of Directors' Corporate Governance/Nominating Committee considers IT and cybersecurity expertise when assessing potential director candidates to help ensure effective oversight by the Board of Directors.

companyName: BANNER CORP

ticker: BANR


text: Management & Strategy A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. We have a comprehensive, cross-functional approach to cybersecurity risk management, driven by our information security management systems and propelled by industry-leading expertise from both our internal information technology security team and top-tier third-party consultants and firms that we engage. Our cyber risk management process is supported by both management and our Board of Directors.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our cybersecurity program includes several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber-attacks, including among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Company continuously monitors and enhances its program to respond to evolving cyber threats and changes in the regulatory environment.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: The Board of Directors considers cybersecurity risk as part of its overall risk oversight function. The Board of Directors receives updates from the CFO regarding the Company's cybersecurity risk management program at least annually. These include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: When appropriate, we utilize external service providers to assess, test, or otherwise assist our program. We also leverage third parties by working with external researchers, operating bug bounty programs, and managing coordinated vulnerability disclosure programs with security organizations. We maintain a systematic approach to assessing and controlling the cybersecurity risks presented by third-party service providers. We require third-party service providers to manage their cybersecurity risks in defined ways, undergo cybersecurity reviews, notify us of cyber events, and satisfy additional contractual requirements.

companyName: MICROSOFT CORP

ticker: MSFT


text: Perrigo has an incident response team comprised of the CISO and senior leadership from Legal, Human Resources and Finance. We have a formalized breach management protocol and playbooks that are tested periodically. Perrigo uses a panel of forensic and third party service providers to assist the Company with its response in the event of a cybersecurity incident. We employ escalation procedures designed to notify management of certain specific cybersecurity threats or incidents. If deemed appropriate, management will notify the NGC, which may convene to discuss the cybersecurity threat before reporting to the Board of Directors on the matter.

companyName: PERRIGO Co plc

ticker: PRGO


text: The Company operates in the biotechnology sector and is subject to various cybersecurity risks that could adversely affect the Company's business, financial condition or results of operations, including intellectual property theft, fraud, extortion, harm to employees, collaborators or vendors, violation of privacy laws and other litigations, legal and reputational risk.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: The Bank's Board of Directors is responsible for overseeing the risks associated with cybersecurity threats. The Strategic Technology Oversight Committee ("STOC") of the Board has primary responsibility for overseeing the technology program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The CISO and the CIO provide quarterly reports to the STOC regarding the information security and technology programs, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The CISO also reports summaries of key issues, including significant cybersecurity and/or privacy incidents. In addition to the STOC, the management-level Operations Committee and the Enterprise Risk Management Committee ("ERM Committee") focus on and provide oversight of the information security program. The ERM Committee reviews and, as appropriate, approves the broad objectives, strategies and policies governing the Company's protection of data assets and information security framework. The ERM Committee additionally assesses the adequacy of information security practices and reports on cyber risk to the Risk Committee of the Company's Board of Directors. The Operations Committee is chaired by the Chief Operating Officer and includes the CISO, CIO and other key departmental managers from throughout the Company. This committee generally meets bi-weekly to discuss various operational strategy and issues, including information technology and information security policies, practices, controls, and mitigation and prevention efforts.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: JUNIPER NETWORKS INC


text: We have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates several components, including employee training, SOC 2 Type 1 controls, multifactor authentication, endpoint monitoring, and we maintain Business Associate Agreements where required.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: We have also implemented cybersecurity training. For example, key information technology and security personnel meet biweekly for training, updates on new cybersecurity threats, and implementation of new policies and all employees are required to undergo annual cybersecurity training, including email and password safety and phishing detection.

companyName: EMCOR Group, Inc.

ticker: EME


text: A cybersecurity incidence response team comprised of key function heads and personnel, including IT, Finance, Legal, and Human Resources, provides operational support for clarifying and acting on cybersecurity issues, including decision-making around materiality, escalation and disclosure. Our cybersecurity program is principally managed by our Chief Information Officer and our Information Security Manager. Together, they have over 50 years of experience in IT, including developing, implementing, and operating IT controls. Our Chief Information Officer and our Information Security Manager manage cybersecurity risks by continually working to reduce risks, respond appropriately to incidents, and invest in hardening our attack surface to improve our cybersecurity posture. Our GRC platform is designed to provide reliability in identifying, tracking, and mitigating cybersecurity risks. We also engage third party assessors, consultants, and auditors to extend internal team capabilities and support our cybersecurity program, including engaging a cybersecurity service provider that provides 24/7 continuous managed detection and response services.

companyName: Clearfield, Inc.

ticker: CLFD


text: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 or SOC1 type II reports (attestation of controls at a service organization over a minimum six-month period). For other third-party service providers, cybersecurity risk is addressed as appropriate.

companyName: CODEXIS, INC.

ticker: CDXS


text: Third-party supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security and risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Kura Oncology, Inc.

ticker: KURA


text: Day-to day management of cybersecurity threats is conducted by our IT department in conjunction with outside service providers, which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Chief Executive Officer and Chief Financial Officer, who are expected to report to the Audit Committee.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: The Technology Risk Management Director is responsible for maintaining the Company's information and cyber security risk management framework. This framework establishes standards and processes for the continuous assessment of material cybersecurity risks, covering identification, measurement, mitigation activities, monitoring, and reporting of the risk posture at any given time. Additionally, the Director ensures oversight and compliance with the Security Incident Response Plan, providing guidance during security incidents, whether within the Company or involving service provider/vendor engagements.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board and the Audit Committee of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the company's ERM function and the Company's Chief Information Security Officer.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: We also have a dedicated team of employees overseeing its data security plan and initiatives, led by our Director of IT. With over fifteen years of experience in the field of cybersecurity, our Director of IT brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of IT also works directly in consultation with internal and external advisors in connection data security planning and initiatives. We engage such external advisors to assist with the evaluation of our technology, security, critical risk areas and related controls to improve our ability to identify and detect, protect against, and recover from, cybersecurity incidents and other evolving threats and to appropriately benchmark against industry practices.

companyName: Shimmick Corp

ticker: SHIM


text: We recognize the importance of protecting information assets such as the personally identifiable information of our employees, and proprietary business information regarding our Affiliates and their clients, and have adopted policies, management oversight, accountability structures, and technology processes designed to safeguard this information. All of our employees are required to attest annually to our information security policies and participate in regular security awareness training to protect their information and the AMG data and systems to which they have access. These trainings also instruct employees on how to report any potential privacy or data security issues.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: The Board, in coordination with the Audit Committee of the Board (the "Audit Committee"), oversees our risk management program, including the management of cybersecurity threats.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles. Our CISO chairs the Company's Cybersecurity Governance Committee, comprised of executive leaders across Legal, Finance, and Corporate Communications, that has oversight responsibilities regarding the Company's information security functions, including infrastructure, governance, privacy, and compliance.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Our board of directors has oversight over cybersecurity risks. Our management provides periodic presentations to the board of directors on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The management provides updates regarding our cybersecurity program to the board of directors when material.

companyName: Amesite Inc.

ticker: AMST


text: The Company's cybersecurity program focuses on the following areas: a. Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.

companyName: Axogen, Inc.

ticker: AXGN


text: We perform risk assessments relating to cybersecurity and technology risks at least annually. Our cybersecurity risk management program has been developed based on industry standards, including those published by the National Institute of Standards and Technology ("NIST"). Highlights of the program include: • Corporate policies and procedures that guide our use of information systems, confidentiality and security strategy; • Identifying critical assets and high-risk threats, and implementing technical prevention and detection controls and response and recovery practices; • A third-party risk management process to assist in making risk-informed technology product and services decisions on third parties who provide, manage, store or have access to material data or information, including the completion of security questionnaires and independent assessments of controls, audits and/or contract terms; • Defined data loss prevention standards in place to detect and prevent data loss, including requiring third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices; • Security awareness training for employees to identify cybersecurity concerns and take appropriate actions; and • Evaluating our program's effectiveness by performing regular internal and third-party assessments of our controls, including external penetration testing and consultation on security enhancements.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: Disclosure of Management's Responsibilities Technology and Information Security Director and Information Security Subdirector Our management possesses significant expertise in the assessment and management of cybersecurity risks. TISD, and the Information Security Subdirector ("ISD"), has extensive experience in the areas of information technology, information security risk management, and cybersecurity. Specific to cybersecurity, the TISD and the ISD have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions that should be taken to mitigate such risks.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we used the National Institute of Standards and Technology Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: BioXcel Therapeutics, Inc.

ticker: BTAI


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Matterport, Inc./DE


text: In terms of physical controls, we co-locate our servers and hosting equipment at a secure third-party data center in Las Vegas, Nevada, which enforces strict employee identification measures and restrictions on unauthorized personnel. In terms of logical and technical access controls, we have designed and implemented information security policies, system access policies, technical monitoring systems, and a variety of other policies and technical security measures. We require all employees to take training courses on an annual basis to review and better understand potential cybersecurity threats. We use third parties to conduct testing of our information systems on a periodic basis to test for potential vulnerabilities.

companyName: MARIN SOFTWARE INC