text: Christopher M. Killian, age 54, is Senior Vice President and Chief Technology Officer. Dr. Killian has responsibility for Eastman's global technology and innovation organization. Prior to this position he served as Vice President of Technology for the AFP, CI, and AM segments. Dr. Killian joined Eastman in 1996 as a research chemist. During his career at Eastman, he has held various leadership positions in technology and the business including Director, Tritan Growth Platform early in his career. Dr. Killian was appointed to his current position effective June 2021.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.

companyName: Boxlight Corp

ticker: BOXL

secItem: Item 1C


text: As part of our broader risk management framework, we have identified potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: The Company is committed to enacting a cybersecurity strategy that provides the necessary framework to ensure confidentiality, integrity and availability of customer, associate and proprietary information.

companyName: TFS Financial CORP

ticker: TFSL


text: Our Information Security Officer directs our enterprise information security department and manages our information security program. The responsibilities of enterprise information security department include cybersecurity risk assessment and defense, vulnerability assessment, incidend prevention, mitigation, response, and remediation, data access governance, third-party risk management, and business resilience. Our Information Security Officer has over ten years of relevant expertise and formal training in the areas of information security and cybersecurity risk management in the financial institutions industry.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Richard Puckett, as our CSO, serves as the chair of the Council. He is responsible for overseeing a unified security program that provides cybersecurity, fire and protection operations, physical security, insider threat, and classified security. Mr. Puckett has nearly 30 years of experience in the cybersecurity industry, including, prior to joining Boeing in 2022, as Chief Information Security Officer of SAP SE and Thomson Reuters Corporation, Vice President, Product and Commercial Security of General Electric, Inc., and Senior Security Architect at Cisco Systems, Inc. He reports directly to the CIO and meets regularly with other members of senior management and the Audit Committee.

companyName: BOEING CO

ticker: BA


text: We have processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. These enterprise-wide processes are based upon policies, practices and standards that guide us on identifying, assessing, and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in our centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in our ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: Marathon Petroleum Corp

ticker: MPC


text: risk management and strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Stereotaxis, Inc.

ticker: STXS


text: Day-to-day responsibility for assessing, managing, and mitigating cybersecurity risk lies with the Company's Chief Financial Officer and Chief Operating Officer (the CFOO), who reports to the President and has a dotted-line reporting relationship to the Audit Committee.

companyName: Perfect Moment Ltd.

ticker: PMNT


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management;

companyName: ARCH RESOURCES, INC.


text: Continuous monitoring and threat detection: our IT security team uses advanced tools for real-time network and system monitoring, enabling rapid detection and response to potential threats;

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Board of Directors' Oversight of Cybersecurity Risks The audit committee of our Board is responsible for the oversight of risks from cybersecurity threats. As part of its oversight, our audit committee and certain members of the Company's management will meet quarterly to discuss ongoing initiatives and to facilitate coordination between Company stakeholders. Annually, our Vice President of Information Technology will review the Company's cybersecurity risk management program with our audit committee and Board.

companyName: Sable Offshore Corp.

ticker: SOC


text: Risk Management and Strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have established certain policies and procedures for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these policies and procedures into our overall risk management framework to promote a company-wide culture of cybersecurity risk management. Such procedures include physical, procedural and technical safeguards, response methods, regular tests on our systems, and routine review of our processes to identify risks and enhance our practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage certain external parties, including consultants and computer security firms to enhance our cybersecurity oversight and provide monthly trainings to our employees. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities. At this time, we are not aware of any material cybersecurity incidents that have impacted the Company. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1 Item 1A Risk Factors in this Annual Report.

companyName: Enveric Biosciences, Inc.

ticker: ENVB


text: The Board receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential, as appropriate.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: Our cybersecurity program also incorporates intelligence sharing capabilities about emerging threats within the utility industry and other industries through collaboration with peer companies and specialized consultants and advisors, public-private partnerships with government intelligence agencies, including the FBI, CISA, and the Department of Energy Office of Cybersecurity, Energy Security and Emergency Response, and geopolitical briefings. We also leverage third-party benchmarking, the results from regular internal and third-party audits, technology partner resources, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Incident Response Team: a Our Incident Response Team, led by our CTO, coordinates the Company's response to cybersecurity incidents. This team includes representatives from IT, legal, investor relations, risk & compliance, and other relevant departments (as required).

companyName: IREN Ltd

ticker: IREN


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CISO reports to the Board Risk Committee, Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting policies.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers, with assistance from third-party consultants or advisors as appropriate, are responsible for the day-to-day management of the material risks we face. Our Chief Financial Officer oversees our cybersecurity risk assessment and mitigation process, and is responsible for the timely reporting of any material cybersecurity incident or threat, as well as any other cybersecurity related risks, to our board of directors.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: Impact of Cybersecurity Events In the fourth quarter of 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or would reasonably be likely to materially affect Graybar, including our business strategy, results of operations or financial condition.

companyName: GRAYBAR ELECTRIC CO INC


text: Oversight of Third-Party Risk We are aware of the cybersecurity risks associated with engaging third-party service providers. To mitigate such risks, we conduct security assessments of high-risk third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes ongoing assessments by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: ENTEGRIS INC

ticker: ENTG


text: Like other financial institutions, the Bank experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware. The Bank also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud. Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact. Unauthorized access to our computer systems or stored data could result in theft, including cyber theft, or improper disclosure of confidential information, and the deletion or modification of records could cause interruptions in our operations. The impact of a material information technology event could have a materially adverse effect on our competitive position, reputation, results of operations, financial condition or cash flows.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: The Audit Committee oversees our cybersecurity posture to assess key strategic, operational, and compliance risks. Our CIO and CISO update the Audit Committee quarterly regarding cyber risks, the threat landscape, reports on our security roadmap, risk mitigation and governance, and any cybersecurity incidents.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: We have implemented a strategy to address threats to Bank assets and confidential information. Our information security program, under the responsibility of the Chief Information Officer and the Chief Compliance & Risk Management Officer, balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Bank and customer information. We annually benchmark our information security program to assess its strength as measured against recommended industry security best practices.


text: Leveraging internal and external auditors as well as security consultants to review the procedures, systems, and controls that comprise our ISSP to evaluate their design and operational effectiveness and to address any operational deficiencies or security weaknesses; and Maintaining an Incident Response Plan that establishes our procedures and standards for responding to actual or potential cybersecurity threats or incidents, which we review at least annually.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Our management team stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Vroom, Inc.

ticker: VRM


text: Sixth Street maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. Sixth Street's Head of Technology Risk periodically discusses and reviews cybersecurity risks and related mitigants with Sixth Street's Cybersecurity Committee and incorporates relevant cybersecurity risk updates and metrics.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Cyber Risk Governance The Audit and Risk Committee is responsible for assisting the Board with oversight of our enterprise risk framework, including cybersecurity, information security, information technology and business continuity and resiliency. Our CISO and other members of senior management including our General Counsel, CCO and CRO report quarterly to the Audit and Risk Committee at its regular meetings on the status of the Company's cybersecurity risk, risk management policies and risk assessment initiatives. the full Board is updated on an as needed basis. In the event of an immediate cyber threat to our business operations, our ISP would involve our General Counsel, who would promptly notify the Chairperson of the Audit and Risk Committee, as to the nature, timing and extent of the threat and our applicable contingency plans would go into effect. Our CRO, in collaboration with our CISO, is responsible for notifying the Audit and Risk Committee of world events or of other significant external events that may pose cybersecurity threats or material risks to our business continuity.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has over twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as Dominion Energy's operations, compliance, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to Dominion Energy's executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Audit Committee of our Board of Directors considers cybersecurity risks and other information technology risks as part of its risk oversight function and evaluates our risk assessment and management policies, including periodic discussions with our senior officers. In addition, management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee also meets at least quarterly with our independent registered accounting firm and communicates with them regarding any cybersecurity-related risks.

companyName: BTCS Inc.

ticker: BTCS


text: Our CDT function has processes to oversee and identify the risks of cybersecurity threats associated with third-party service providers and monitors and works to mitigate the impact of cybersecurity incidents encountered by our third-party service providers. Upon becoming aware of cybersecurity incidents encountered by our third-party service providers, the CDT function's Incident Response and Cyber Threat Intelligence teams are deployed to evaluate and mitigate the impact of such incidents on our business.

companyName: AMGEN INC

ticker: AMGN


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "We could be negatively impacted by security threats, including cyber security threats, and related disruptions" and "Our earnings and profitability depend, in part, upon subcontractor performance and raw material and component availability and pricing," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: Our management team, including our CISO, is responsible for assessing and managing our risks from cybersecurity threats under the cybersecurity committee's oversight. Our current CISO has nearly 20 years of cybersecurity experience in both the public and private sectors. His senior public sector roles include Senior Policy Advisor and the Director of Stakeholder Engagement in the Office of the National Cyber Director, Chief of Cyber Threat Analysis at the Cybersecurity and Infrastructure Security Agency (CISA), CISO of the Pandemic Response Accountability Committee, and Deputy CISO of the Pension Benefit Guaranty Corporation.

companyName: SailPoint, Inc.

ticker: SAIL


text: The Chief Financial Officer, who is responsible for assessing and managing our cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The Chief Financial Officer has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: The Board has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the Board. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to the Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Transformation and Chief Information Officer ("CIO") who receives reports from our Senior Cybersecurity manager who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. The dedicated personnel of information system security professionals are overseen by an information security manager with 15 years of experience in cybersecurity. Management, including the CIO and our cybersecurity manager, regularly update the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, a third-party risk program, vulnerability management, and on-going cybersecurity projects.

companyName: Worthington Steel, Inc.

ticker: WS


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a cybersecurity incident response program. Pursuant to the program and its procedures, a Security Incident Response team (SIRT), which is a team lead by the Head of IT and comprised of cross-functional personnel, is responsible for handling potential cybersecurity incidents. We also maintain business continuity and disaster recovery plans in the event of a significant cybersecurity incident.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Management is also responsible for employee training and awareness programs, ensuring that cybersecurity is embedded in the corporate culture. All employees complete mandatory cybersecurity training to recognize and mitigate phishing attempts, malware threats, and social engineering risks.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: As of the date of this Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risks titled " We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors. " No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: security team responsible for managing our cybersecurity risk assessment processes and security the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls;

companyName: Fold Holdings, Inc.

ticker: FLD


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties and incorporating third-party risk into our incident response plans.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, amongst others, data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and quarterly thereafter.

companyName: Loop Industries, Inc.

ticker: LOOP


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity incidents, including data security breaches or computer viruses, could harm our business by disrupting our business operations, compromising our products and services, damaging our reputation or exposing us to liability".

companyName: HARMONIC INC.

ticker: HLIT


text: Our company ensures that all new hires and existing employees undergo data security and privacy training annually, with additional specialized training for certain roles. Periodic campaigns and simulated phishing tests are also conducted to maintain awareness and vigilance against potential risks.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW


text: The CISO leverages both open source and private threat intelligence sources to remain current about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes and technologies for regular monitoring of our information systems. Third party cybersecurity advisory services are employed to consult on, monitor, respond and/or assess our IT landscape and cybersecurity response.

companyName: CLEAN HARBORS INC

ticker: CLH


text: We maintain a set of core practices and procedures when responding to certain high-risk information security threats and incidents, which are designed to ensure appropriate resources are utilized to provide an effective, timely, and coordinated response in managing crises, including significant cyber threats and incidents. Our Management Risk Committee will assume overall responsibility in an effort to ensure that the appropriate functions and work streams are mobilized and coordinated to effectively manage any significant cyber events.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Framework for Identifying and Mitigating Threats: We follow a framework for identifying and mitigating cybersecurity threats, which outlines procedures for threat detection, incident response, and risk mitigation.

companyName: Venu Holding Corp

ticker: VENU


text: Policies and Procedures. We maintain a set of cybersecurity policies and procedures that are regularly reviewed and updated. These policies are crafted in accordance with certain components of the National Institute of Standards and Technology Cybersecurity Framework, which provides a policy foundation for critical infrastructure security. These policies govern our cybersecurity program, including but not limited to access control, system development life cycle management, change management, and incident response.

companyName: EVgo Inc.

ticker: EVGO


text: While we work with third-party cybersecurity firms, where appropriate, to assess aspects of our security architecture and processes, our information security team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents.

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants The company engages cybersecurity consultants and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments and penetration testing to identify weaknesses and recommend improvements. Additionally, the company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, including a managed security service provider to augment the company's internal resources, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Our general partner's board of directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Company. The board considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee primary responsibility for oversight of the Company's risk management practices, including oversight of cybersecurity and other information technology risks.

companyName: Hess Midstream LP

ticker: HESM


text: We have implemented controls and processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. The Trust's management, including its Principal Executive Officer and Principal Financial Officer, has direct oversight of the management of cybersecurity risks.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: While we do not currently have third-party collaborations, the Company plans to implement a process for selecting and evaluating third-party service providers in the future. This will include comparing services, signing security agreements, and having our internal engineers assess the third parties' achievement of security objectives.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program. The SMT designates the CISO who also serves as the IRT leader. As part of its oversight responsibilities, the Board of Directors is responsible for discussing with the SMT our company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including our risk assessment and risk management policies. The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, the Board of Directors reviews with the SMT significant areas of risk exposure involving cybersecurity.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. Refer to Item 1A for a discussion of cybersecurity risks.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: Our Chief Information Officer ("CIO") helps identify, assess and manage the Company's cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage, mitigate and remediate material risk from cybersecurity threats to our Information Systems and Data. Our Information Security and Privacy Policy includes standards for incident response, vulnerability management, data protection and logical access controls.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: To manage our cybersecurity governance, we use Coalition Control, a cyber risk management platform that combines insurance, technology, and services from Coalition and its partners into an online experience. It allows us to detect, assess, and mitigate cyber risks proactively.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: Cybersecurity threats are inherent in the banking and financial services industry. To safeguard our customers' sensitive data, financial transactions, information systems and information assets, we have established a comprehensive cybersecurity risk management program that is part of our enterprise risk management strategy. Our risk management team oversees the program and regularly collaborates with our information security function, led by our Chief Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: As of December 31, 2024, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: We are occasionally subject to cybersecurity incidents and we use our IRP to respond to such incidents. Our systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations. We also occasionally experience the misuse or unauthorized disclosure of personal information, other data, confidential information or intellectual property. We occasionally experience account take overs by bad actors using the credentials of customers acquired from the dark web unrelated to any breaches in our systems. These incidents have not had a material impact on us to date, including our business strategy, financial condition, or results of operations. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, financial condition, or results of operations. For more information about the cybersecurity risks we face, see the risk factor titled "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or to otherwise protect our confidential information, could damage our reputation and brand and harm our business, financial condition, and results of operations" under Item 1A "Risk Factors" of this Annual Report on Form 10-K.

companyName: Chewy, Inc.

ticker: CHWY


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response processes, disaster recovery and business continuity plans, encryption of certain data, network security controls and access controls in certain environments and systems, monitoring certain systems, physical security of certain assets, asset management, employee training, and cybersecurity insurance.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: Our Board is responsible for the overall oversight of our enterprise risk management. The Board receives regular updates on the key risks to the organization on a quarterly basis. The Board has delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives quarterly and yearly cybersecurity updates from the Company's Chief Information & Security Officer ( CISO), which includes updates on the Company's cybersecurity policies and strategies, cyber risks and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape, and engagement with external cybersecurity experts and advisors, as needed.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: T he Board also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Senior Director of Information and Cyber Security ("SDICS"), or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Metsera, Inc.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Vice President of Information Technology, who is responsible for management of our IT program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Vice President of Information Technology and representatives from Legal and/or Risk Management, as applicable.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Quantitative metrics for evaluating a security incident include the potential or actual financial loss, the costs of impacted data records, remediation costs, and/or third-party expenses. Qualitative factors include potential or actual impacts to Tyler's reputation and/or competitiveness, disruptions to Tyler's business, and/or risk of litigation or regulatory action. In evaluating an incident, Tyler also works to assess whether the incident is related to another recent incident and whether the incident may represent a threat to national security. Tyler does not expect an incident to rise to that level unless Tyler infrastructure is deemed "critical infrastructure" by the Cybersecurity and Infrastructure Security Agency ("CISA").

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, such as engaging an independent third party to conduct regular assessments of its cyber security maturity against industry best practice frameworks and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Audit Committee as part of the CISO's regular briefings, and in turn the Audit Committee Chair regularly updates the Board on such briefings.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."

companyName: Vestis Corp

ticker: VSTS


text: Overall, we implement, develop, and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage information systems or data on such systems, change frequently, we must continually monitor and update these systems and programs. See "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including risks related to cybersecurity incidents and privacy and data protection.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Information security policies, network and device security, encryption standards, risk management, as well as security tools such as malware protection and secure authentication tools.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: Our risk management program is documented in our written Information Security Policy. We periodically update our Information Security Policy, along with other policies and procedures, to adapt to evolving business conditions and threats.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, prior cyber incidents have not had a material adverse effect on our business. For a further explanation of the cybersecurity risks and threats that we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: STEM, INC.

ticker: STEM


text: We describe whether and how risks from identified cybersecurity threats have or are reasonably likely to materially affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Independence Contract Drilling, Inc.


text: Our ERC Committee oversees our overall approach to enterprise risk management, of which cybersecurity is an important component. The ERC Committee and its Chair, in coordination with the Information Security Team and CISO, regularly review the categories of risk the Company faces, including any cybersecurity risk exposures, as well as the likelihood of occurrence, the potential impact of those risks, and the steps management has taken to monitor, mitigate and control such exposures. To facilitate these reviews, the Information Security Team and CISO report at least quarterly to the ERC Committee with respect to cybersecurity risks, including those identified through review of our business, of rising threats in the industry, and of the current state of the Company's cybersecurity and information security program. The ERC Committee makes regular reports to the full Board of Directors regarding updates on cybersecurity and other risks.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Chief Security Officer Our Chief Security Officer has over 20 years of professional experience in information security, including over 8 years as Fannie Mae's Chief Information Security Officer (2016-2024) and over 1 year as Fannie Mae's Deputy Chief Information Security Officer. Our Chief Security Officer holds a graduate degree in information technology management.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We comply with the AICPA Trust Services Criteria for Security and have based our Information Security Management System on the ISO 27001 standard.

companyName: Track Group, Inc.

ticker: TRCK


text: The board of directors, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with our CISO.

companyName: Marpai, Inc.

ticker: MRAI


text: The Company and its third-party service providers conduct periodic risk assessments to identify significant cybersecurity threats that may affect information systems that are vulnerable to such cyber security threats and regularly review these risk assessments for changes in our business practices and the external cybersecurity landscape as well as the impact of our security processes. These risk assessments include physical, administrative and technical safeguards and involves identification of reasonably foreseeable internal and external risks and evaluation of the likelihood and potential damage that could result from the realization of such risks.

companyName: Talis Biomedical Corp

ticker: TLIS


text: As of the date of this Form 10-K, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information on the cybersecurity risks we face that could adversely impact us, please see "Part I, Item IA - Risk Factors - If our network security measures are breached and unauthorized access is obtained to a customer's data, to our data, or to our information technology systems, we may incur significant legal and financial exposure and liabilities and may experience disruptions in our operations".

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, under the heading "Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits" included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.

companyName: Travel & Leisure Co.

ticker: TNL


text: Cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats that we face, and regarding our likelihood of being materially affected by risks from cybersecurity threats, please see Item 1A, "Risk Factors".

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: We maintain a comprehensive information security policy that is intended to maintain the security and confidentiality of client information, protect against threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. We have a written information security program that is aligned to our information security policy and designed to assess, identify and manage risks that result from cybersecurity threats. The program is overseen and executed by a team of experienced, certified cybersecurity professionals. Our information security program is centered on preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and cyber incidents while ensuring our processes continue to operate effectively. Annually, and at onboarding, our employees are required to take information security training. Employees also receive periodic education announcements on cybersecurity related topics to help them in their role in protecting the Bank and our clients from cybersecurity threats. Employees are tested on a monthly basis with simulated phishing emails and if necessary additional training is assigned.

companyName: SANDY SPRING BANCORP INC


text: Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Propanc Biopharma, Inc.

ticker: PPCB


text: Risk Management and Strategy IT plays a crucial role in all of our operations. To remain competitive, our hardware, software and related services must properly and efficiently interact with our suppliers' and customers' products, services and technology, record and process our financial transactions accurately, and obtain accurate and timely data and information to enable our analysis of trends and plans and the execution of our strategies. Accordingly, KLX maintains a cybersecurity risk program led by our internal IT department and strategic vendors designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. These processes are integrated into the Company's overall enterprise risk assessment. Our cybersecurity risk program references industry-standard frameworks and incorporates policies and practices designed to protect the privacy and security of our sensitive information.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: We mitigate risks from cybersecurity incidents using a multi-faceted approach that includes, but is not limited to: establishing information security policies and standards, implementing information protection processes and technologies, assessing cybersecurity risk through vulnerability assessments and audits on an annual basis, reviewing newly developed cybersecurity standards or legislation, implementing cybersecurity training, monitoring our information technology systems for cybersecurity threats and collaborating with public and private organizations on best practices.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: Our Leadership Committee is responsible for the oversight of risks from cybersecurity threats. The Leadership Committee receive updates on a quarterly basis from leaders of our IT department and compliance and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity, and data privacy incidents (if any) and status on key information security initiatives. Our Leadership Committee and IT department discuss cybersecurity-related current events and any updates to our cybersecurity risk management and strategy programs.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: The Adviser has a comprehensive cybersecurity incident response plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our executive officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: We employ additional electronic safeguards to control/limit access to the data contained in those systems. We review and re-assess these processes on a rolling basis with the assistance of both internal staff and outside vendors, including assessors, consultants, auditors, and other third parties. Some steps we take include the use of standard security protocols such as password maintenance, multi-factor identification, and penetration testing. We take other steps as may be situationally appropriate for the specific risk presented.

companyName: FONAR CORP

ticker: FONR


text: We have also established a security governance council (the "Council") to further strengthen our cybersecurity risk management activities across the Company. The Council includes our Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Secretary, Executive Vice President and Chief Operating Officer, Executive Vice President – National and Market Operations, Senior Vice President and Chief Information Officer, Vice President and Chief Information Security Officer, Vice President, Chief Compliance Officer, Vice President, People Services, and Associate Vice President, Internal Audit. The Council plans to meet quarterly beginning in 2024 and is responsible for management's oversight of our IT security in a cohesive and holistic manner that is designed to enable optimal decision-making.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not directly or fully comply with all elements of these standards. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.

companyName: Vimeo, Inc.


text: The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Battery Future Acquisition Corp.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-State actors, and other malicious internet-based activity, continue to increase. Cybersecurity threats may also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees, and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We work with team members at all levels to educate them about evolving risks, from well-known tactics and scams (e.g., phishing) to their more sophisticated descendants (e.g., spear phishing and smishing). Team members receive training on data security and privacy practices and are included in periodic awareness campaigns to test real-world responses. We continue to add further training opportunities as they become available and have incorporated "tabletop" exercises for our Board, our management team, and our team members into our risk mitigation efforts to help us refine our business interruption and response plans. The Company also employs and enforces policies to guide team member behavior and help protect against threats, which includes steps such as regular password updates, and obtaining permission to install third-party programs. Team member training reinforces the Company's risk management policies and procedures and the expectation that all team members will adhere to them.

companyName: Portillo's Inc.

ticker: PTLO


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the latest International Organization for Standardization's ("ISO") information security management system audit using the 27001:2022, 27701:2019, and 27017:2015 frameworks. Successfully achieving these three certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our three ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP and FedRAMP.

companyName: AvePoint, Inc.

ticker: AVPT


text: We also consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We have not identified cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including with respect to our business strategy, results of operations or financial position.

companyName: NorthStar Healthcare Income, Inc.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. The CIO oversees a cybersecurity team, comprised of internal and external subject matter experts who work collaboratively to achieve our cybersecurity objectives. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: As part of its broader risk oversight activities, the Board of Directors regularly oversees business, strategic, operational, and financial risks facing Zuora, including cybersecurity risks and mitigation plans, primarily through delegation to the Audit Committee. As reflected in the Audit Committee Charter, the Audit Committee periodically reviews with management our cybersecurity and other information technology risks, controls, and procedures, including Zuora's plans to mitigate cybersecurity risks and respond to potential data breaches. To ensure the Audit Committee may carry out these responsibilities, our management team provides regular information technology and cybersecurity updates, including metrics regarding cyber threat response preparedness, program maturity milestones, risk mitigation status, and the current and emerging threat landscape. In addition, the Audit Committee periodically reviews and provides input regarding the level of information security risk insurance coverage we maintain. The full Board of Directors receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. One of our directors who serves on the Audit Committee recently underwent formal cybersecurity training and earned a National Association of Corporate Directors CERT Certificate in Cybersecurity Oversight.

companyName: ZUORA INC


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2025.

companyName: Rapid Line Inc.

ticker: RPDL


text: Management's Role in Cybersecurity Risk Management The Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants engaged by the Investment Advisor. The Company's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, and/or information technology.

companyName: FIDUS INVESTMENT Corp

ticker: FDUS


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, research, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, future lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, and harm to our vendor relationships. The company is currently in the process of implementing a more formalized cybersecurity program.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: NETLIST INC

ticker: NLST


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program pursuant to the audit committee's charter. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities from our Executive Director of IT or CFO. The audit committee may update the full board of directors on matters relating to cybersecurity risk management as needed.

companyName: Adicet Bio, Inc.

ticker: ACET


text: We also require appropriate third -party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

companyName: Sharplink, Inc.

ticker: SBET


text: To operate our business, we utilize certain third-party service providers to provide a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms and encryption and authentication technology. Depending on the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, or requiring that the vendor certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: BioCardia, Inc.

ticker: BCDA


text: We assess the Company's Information Security program using an industry cybersecurity framework from the National Institute of Standards and Technology. This program includes policies, processes and procedures that help assess and identify our cybersecurity risks and inform how security measures and controls are developed, implemented and maintained. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls and impact of controls on operations.

companyName: Digital Media Solutions, Inc.


text: Impacts from Cybersecurity Threats As of the date of this report, the Company and our service providers have been subject to certain cybersecurity incidents (including phishing attempts). We are not aware of any prior cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to the business. See "Risk Factors" in Item 1A of Part I for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: KLX Energy Services Holdings, Inc.


text: The Company's audit committee has oversight over cybersecurity risks. With the input of other members of Company management and the Company's information technology providers, the Chief Executive Officer provides periodic presentations to the audit committee on the Company's cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: Our cybersecurity strategy is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology ("NIST") guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.

companyName: TRANSCAT INC

ticker: TRNS


text: Board Oversight of Cybersecurity Matters The Company's board of directors (the "Board") considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on the Company's cybersecurity risk, monitoring, and mitigation activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.

companyName: CVR ENERGY INC

ticker: CVI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity and Reliability." Our Board addresses the Company's cybersecurity risk management as part of its general oversight function.

companyName: EVERBRIDGE, INC.


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify, manage and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments using the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We engage third party experts to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. These outside experts are utilized on a rotating basis to enable us to receive multiple viewpoints on the security of our technological resources. Additionally, from time to time, our internal audit function, reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on our vendors and other third party service providers in our clinical development activities as well as to manufacture and deliver our products, and a cybersecurity incident at a vendor or other third party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.

companyName: INCYTE CORP

ticker: INCY


text: As part of the Company's information security training program, all employees participate in various cybersecurity awareness activities, including an annual Information Security Awareness training module and monthly simulated email phishing events. In addition to our internal resources, we leverage third-party service partners to expand the capabilities of our cybersecurity program. This may include testing the program's protection measures as well as services for incident detection, investigation, and recovery. We also leverage third-party service providers to conduct tabletop exercises and perform assessments against cybersecurity frameworks. In fiscal year 2025, Air Products conducted a comprehensive internal audit of its cybersecurity program to evaluate the effectiveness of controls across enterprise information technology, operational technology, and pipeline environments.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Certain members of our management team and IT department are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: Our management team, including, among others, our Chief Financial Officer, General Counsel and Vice President of Risk Management, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The management team works closely with our director of cybersecurity and technology operations who has over eight years of experience in IT security, industry certifications, specialized training, and over fifteen years of experience in commercial real estate technology.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: FIS remains focused on making additional strategic investments in information security to protect our clients and our information systems from risks from cybersecurity threats. This includes both capital expenditures and operating expenses on hardware, software, staff and consulting services. These investments in the past have been and are reasonably likely to continue to be material to our results of operations. Further, notwithstanding our investments and other processes and efforts described above and elsewhere in this Annual Report on Form 10-K, we cannot guarantee that FIS will not be the subject of a cyberattack that would have a material effect on its financial condition or results of operations. See "Risk Factors."

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard our information systems and protect the confidentiality, integrity, and availability of those systems and our data maintained on them.

companyName: HashiCorp, Inc.


text: We use external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls.; and the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls.

companyName: Jet.AI Inc.

ticker: JTAI


text: As noted above, the Company relies on its Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by its Manager. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our Manager's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: To our knowledge, Murphy has not experienced any cybersecurity incidents that have had, or are likely to have, material impacts to our business, operations, finances, or reputation.

companyName: MURPHY OIL CORP

ticker: MUR


text: We primarily rely on commercially available, third-party software and cloud-based service providers to support our business operations. These third-party providers generally maintain their own security features, such as access controls and data protection measures, and we rely on such features to safeguard our limited information systems.

companyName: Bodhi Tree Biotechnology Inc

ticker: BDTB


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our board of directors oversees our enterprise risk register and cybersecurity program, including related policies and procedures. As part of this oversight, the audit committee of our board of directors receives regular status reports and updates from our management team and conducts periodic executive sessions with our Vice President, Information Technology. Such status reports and executive sessions cover cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.

companyName: Transocean Ltd.

ticker: RIG


text: Due to the complexity and evolving nature of cybersecurity threats, the Company has engaged from time-to-time external experts, including cybersecurity assessors, third-party legal consultants, and auditors, to evaluate and test its risk management systems. The Company engages these third-parties to conduct regular audits, threat assessments and consultation on security enhancements. These interactions are intended to enable the Company to leverage specialized knowledge and insights, in an attempt to ensure its cybersecurity strategies and processes remain at the forefront of industry practices.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Our Board is responsible for strategy, risk and governance, including oversight of risks from cybersecurity threats. The Board has delegated to the Audit Committee primary responsibility for oversight of cybersecurity risk management and the associated internal control systems. The Audit Committee is currently made up of six independent directors with a range of relevant cybersecurity, information technology and operational technology experience.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: In fiscal 2024, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: SentinelOne, Inc.

ticker: S


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, our Director of Information Security, and our Director of Infrastructure. These individuals collectively have over 85 years of prior work experience in various roles in the information security field, including managing and implementing effective information technology and cybersecurity programs, as well as relevant degrees and certifications, including a Certified Information Systems Security Professional certification. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Information Officer reports to the entire Board about cybersecurity threat risks, among other cybersecurity matters, at least twice annually or more frequently as circumstances may require.

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: As a medical device manufacturer that directly interacts with both healthcare professionals and patients, we recognize data privacy and cybersecurity as fundamental imperatives. Like all companies of our size, computer system complexity, and geographic reach, our information systems are subject to constant probing from outside actors and potentially vulnerable to internal and external malicious intrusion, cyberattacks and computer viruses. Because the techniques used to obtain unauthorized access or sabotage systems change frequently and, generally, are not recognized until launched against a target, we maintain a multifaceted approach to assessing, identifying and managing our material risks related to cybersecurity threats. This approach is integrated into our overall risk management processes. We use both technology-based solutions (e.g., anti-virus software, automated intrusion detection systems, spam filters, encrypted virtual private networks) and human-based solutions (e.g., data management policies, outside penetration testing, employee training and testing, independent audits) to defend against cybersecurity threats. We reinforce our commitment to a strong cybersecurity culture through security training and awareness programs. Education on topics such as data security, privacy practices, email and mobile security as well as tailored topics such as secure programming for developers make our employees aware of the need to make sound cybersecurity decisions. Our goal is to promote a culture of thorough security and impress upon our employees that everyone has a part to play in securing corporate data and information systems.

companyName: NovoCure Ltd

ticker: NVCR


text: The Audit Committee periodically reports to the full Board regarding its activities, including in relation to its oversight of cybersecurity risks. The full Board also discusses cybersecurity matters with management at least annually.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: Our Cybersecurity Team assesses cybersecurity risks, including those related to our supply chain and third-party service providers that have access to our systems or facilities where JAKKS' data is stored. The team assesses how cybersecurity risks affect or are reasonably likely to materially affect the Company, including our operations or financial position. Our Cybersecurity Team is responsible for the Company's risk assessment, risk management, disaster recovery, and auditing of JAKKS overall cybersecurity program. The Cybersecurity Team meets with the Cybersecurity Subcommittee of the Board of Directors to discuss, identify, and address cybersecurity risks and review updates to our risk management program to ensure cybersecurity risks to the organization are mitigated. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors beginning on page 22 of the section entitled "Item 1A. Risk Factors" in this Form 10-K.

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. Our management team provides regular updates to our audit committee regarding the results of our cybersecurity risk assessment measures and associated enhancement actions.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: We have not experienced a cybersecurity incident that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.

companyName: SS Innovations International, Inc.

ticker: SSII


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. For example, cybersecurity threats are subject to our firm-wide Risk Events Policy, which sets forth procedures for the identification, escalation, recording, investigation and approval of handling of such risk events.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Under Federated Hermes' cybersecurity program, Federated Hermes conducts regular threat identification and assessment exercises. Some of these exercises involve the use of third-party cybersecurity experts, who assist with, among other things, system penetration testing and system design. Information gained from such exercises is used to develop and refine protective and detective strategies and tactics. Federated Hermes' information systems and assets are also monitored to identify cybersecurity incidents and verify the effectiveness of existing protective measures. New protective measures are deployed from time to time as threats evolve. Some of the measures employed by Federated Hermes to mitigate cybersecurity risk include, among others, use of firewalls, system segmentation, system monitoring, virus scanning, and periodic penetration and phishing testing. Federated Hermes' cybersecurity program also includes a detailed incident response plan for responding to cybersecurity threats. Federated Hermes' cybersecurity program also requires periodic training of employees on cybersecurity threats, including phishing, and cybersecurity awareness campaigns.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Our general counsel, with oversight by the Vertex Executive Leadership Team, is responsible for assessing and managing our material risks from cybersecurity threats. This team of attorneys and certified risk and information security professionals, has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our general counsel's experience includes over twenty years of legal, information security, compliance, and risk experience and positions of leadership in global organizations supervising information security, compliance, and risk professionals and programs.

companyName: Vertex, Inc.

ticker: VERX


text: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While CNX maintains cybersecurity insurance, the costs related to cybersecurity threats or incidents may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Form 10-K.

companyName: CNX Resources Corp

ticker: CNX


text: As of the date of this report, we do not believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial condition for the reporting period covered by this report. For information regarding cybersecurity risks, see our discussion above in Item 1A. Risk Factors - Risks Related to Our Business - Our internal computer systems, or those of our third party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our commercial, research and development and other programs.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: We take an active role in ensuring the confidentiality, integrity, and availability of data, systems, processes, applications, and products. We are diligent when it comes to safeguarding the data of our strategic partners, employees, existing and future customers, and our teams throughout the globe. We take the protection of proprietary information, intellectual property, and sensitive information seriously, making it our commitment to provide comprehensive prevention, detection, and response capabilities, in order to maintain integrity.

companyName: CONMED Corp

ticker: CNMD


text: Enterprise Risk Management embeds risk management into the oversight of cybersecurity as an integral part of the business with comprehensive internal control and assurance processes linked to key risks which are then reported to the Board of Directors ("Board"). Risk oversight, including cybersecurity is a key risk which has been delegated to the Enterprise Risk Committee of the Board ("ERC"). Cybersecurity is integrated into the Corporation's Enterprise Risk Management Policy, Enterprise Risk Management Committee Charter, Escalation Policy, Risk Appetite Statement, Information Technology Steering Meetings, and Division Risk Meetings. Employees are trained on their first day of employment with regards to cybersecurity and additional training is rolled out for all employees throughout the year.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG