text: In support of our commitment to cybersecurity, we employ a comprehensive strategy which is intended to protect our digital infrastructure, which strategy is supported by both management and our Board of Directors. Our Board of Directors is responsible for overseeing our risk management activities in general, and certain of our Board committees assists the Board of Directors in the role of risk oversight. The full Board of Directors receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the Federal Financial Institutions Examination Council (the "FFIEC"), the International Organization for Standardization and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.

companyName: Amalgamated Financial Corp.

ticker: AMAL

secItem: Item 1C


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based on the potential impact, likelihood, velocity, and vulnerability of risks, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our cybersecurity risk management framework is integrated into our overall ERM process which is managed, administered, and governed by our senior executive team under the oversight of the Board. As part of our ERM program, our senior executive team has delegated the initial identification and assessment of the Company's leading risks to an ERC which is comprised of executives from various operating segments and functional departments across the Company, inclusive of information security.

companyName: Schneider National, Inc.

ticker: SNDR


text: Managing Material Risks & Integrated Overall Risk Management The Company has incorporated cybersecurity risk management within its Enterprise Risk Management framework. Led by the Company's Senior Vice President of Operations, the Company's risk management team, comprised of senior management team members, integrates the evaluation of cybersecurity risks in accordance with its business objectives, operational needs, and legal requirements.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. As mentioned above, the changes in our business and operations may impact our cybersecurity program in the future. In addition, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: We have implemented a risk-based information/cybersecurity program dedicated to protecting our data and solutions. Our privacy policies, together with associated controls and procedures, provide a comprehensive framework to inform and guide the handling of data. We employ a defense-in-depth strategy, utilizing the concept of security layers and the CIA (confidential, integrity and availability) triad model. Our information security program is led by our Chief Information Security Officer ("CISO") and the Information Security department, which establishes the policies, standards and strategies to manage security risk. The CISO has more than two decades of experience with global technology organizations across multiple industries. We devote significant resources to addressing security vulnerabilities through enhancing security and reliability features in our products and services, providing employee security training, monitoring our operations 24 hours a day and 7 days a week, reviewing and auditing our systems against independent security control frameworks, and performing security maturity assessments. We may, from time to time, engage third-party consultants, legal advisors or audit firms in evaluating and testing our risk management systems and assessing and remediating certain potential cybersecurity incidents. These assessments inform our annual and multi-year cybersecurity strategies and our product security plans. In addition, our operations depend on a number of third parties, including vendors, developers and partners, that are critical to our business and to which we may grant access to our customer or employee data. We conduct due diligence on these third parties with respect to their security and business controls, and we have established monitoring procedures in an effort to mitigate risks related to data breaches or other security incidents originating from these third parties.

companyName: DELUXE CORP

ticker: DLX


text: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers and customer-facing products and applications.

companyName: Sinclair, Inc.

ticker: SBGI


text: We recognize the importance of maintaining the trust and confidence of our publishers, buyers, partners, customers, and employees. The Audit Committee of our Board ("Audit Committee") is responsible for oversight of the Company's cybersecurity function and efforts, and receives quarterly updates from management regarding the Company's cybersecurity policies, standards, processes, and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity risk management program is overseen by our Senior Vice President, Infrastructure and Security ("SVP Security"), who also serves as our Information Security Officer, our executive management team, and our Board through the Audit Committee.

companyName: PubMatic, Inc.

ticker: PUBM


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations. For cybersecurity, we collaborate with expert consultants and third-party service providers to implement industry-standard strategies aimed at identifying and mitigating potential threats or vulnerabilities within our systems. Additionally, the policy strategy will have a comprehensive cyber crisis response plan to manage high severity security incidents, ensuring efficient coordination across the organization. We are aware of the risks associated with third-party service providers and have implemented policies and processes to oversee and assist with managing these risks. Our management team evaluates third-party providers before engagement and monitors these providers on an ongoing basis commensurate with the level of risk and complexity of the relationship with, and the activities performed by, such providers. This approach is designed to help identify and mitigate risks related to data breaches or other cybersecurity incidents originating from third-parties in order to better protect our assets and data.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: The Trust's cybersecurity protocols include, but are not limited to, and intrusions, and isolated computer workstations. The Trust's personnel are aware of the potential of a cybersecurity incident and exercise caution to ensure no such incident occurs. The primary entities with which the Trust conducts business are banks, outside service providers, and vendors, which have their own cybersecurity protocols. Interactions between the Trust's information facilities passwords, passphrases, and two-factor or independent authorizations.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: We have established information security protocols aimed at the identification, assessment, and management of significant cybersecurity risks that could impact our vital information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate cybersecurity risks, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence review, as well as internal and external assessments.

companyName: ONITY GROUP INC.

ticker: ONIT


text: As part of our risk management program, we also assess cybersecurity risks associated with third-party service providers. We have processes in place to oversee and identify material risks from cybersecurity threats associated with our engagement of such providers, including the use of cybersecurity risk criteria when determining the selection and oversight of those service providers.

companyName: CLARIVATE PLC

ticker: CLVT


text: Through third parties we are also able to rapidly deploy forensic analysis, legal services, notification, and call center service(s). Our incident response and change management policies and procedures were designed based on guidelines from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").


text: The Company's NIDSP Guidelines and policies apply not only to the Company's employees and consultants but also to any third parties that access or utilize the Company's information and systems. Such third parties may include the Company's service providers, customers, suppliers, contractors, consultants, and any other individuals the Company conducts business with. The IT infrastructure that the Company has developed in accordance with the NIDSP Guidelines is designed to monitor both internal and external cybersecurity risks. The NIDSP Guidelines equip the Company with the tools and systems necessary to recognize, address, and protect against risks associated with its third-party interactions.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: External Evaluations: We regularly commission third parties to conduct in-depth assessments to ensure an unbiased and comprehensive evaluation. These include information security maturity assessments, audits, and independent reviews of our information security control environment and its operational effectiveness.

companyName: WIDEPOINT CORP

ticker: WYY


text: On a periodic basis, but not less than annually, the COO, with the assistance of IT Department and Compliance/Risk Management staff, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessments, the company's processes and policies may be revised to protect against any anticipated threats or hazards to the security or integrity of such information.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes. The IT Security Department carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Additionally, the IT Department assesses and improves the Company's cybersecurity risk management processes on an annual basis by: (i) engaging its cyber insurance broker, AON, plc, to complete a benchmarking evaluation to compare the Company's cybersecurity posture against peers and (ii) engaging cyber risk readiness and response company, Netdiligence, to conduct vulnerability and penetration testing, which produces a report that specifies any possible risk area and devices. Such report is presented to the IT Department for analysis and for the purpose of developing subsequent action plans to remediate any vulnerabilities. As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial conditions, except as otherwise noted.

companyName: ASHFORD HOSPITALITY TRUST INC

ticker: AHT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could result in adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: periodic vulnerability assessment and penetration testing on shore and on vessels to review our cybersecurity a multi-vendor approach to reduce the risk of the compromise of a major cybersecurity vendor;

companyName: DORIAN LPG LTD.

ticker: LPG


text: Third-Party Service Providers: The Funds engage with various third-party service providers for critical operations and services. The Sponsor conducts rigorous cybersecurity risk assessments of all vendors and business partners with access to our networks or sensitive information. These assessments ensure that third-party cybersecurity policies are robust and align with our cybersecurity standards.

companyName: VS Trust

ticker: SVIX


text: As part of the Program, the Company: deploys technical and organizational safeguards designed to protect the Company's networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company's response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises.

companyName: American National Group Inc.

ticker: ANG-PD


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal information technology ("IT") personnel working in conjunction with specialized outside security consultants on a day-to-day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Our Board of Trustees considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.

companyName: Seritage Growth Properties

ticker: SRG


text: Our board of directors has oversight responsibility for our overall enterprise risk management and directly oversees our cybersecurity risk management. As part of its enterprise risk management efforts, our board of directors regularly receives reports from management on our cybersecurity programs with regard to any risks that may arise from specific cybersecurity threats and incidents. The board of directors oversees management's programs, policies and processes in place that identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which we are exposed.

companyName: AstroNova, Inc.

ticker: ALOT


text: Our Senior Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures that help to identify, assess, and manage the Company's cybersecurity threats and risk. Our DO working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests. Based on these meetings, our DO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of Quanta. The Board oversees management's implementation of our cybersecurity risk management program, receiving regular reports from management (including our Senior Vice President of Technology) on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: We plan for our Chief Financial Officer to provide our Audit Committee with quarterly general risk assessment updates, which shall cover cyber risk topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee is also involved in the reporting function of our incident response plan which includes communication of any cybersecurity incident that meets our reporting thresholds, as well as ongoing updates regarding any such incident, until such incident has been resolved.

companyName: Quantum-Si Inc

ticker: QSI


text: We have established a proactive approach to identify and manage material cybersecurity threats which includes, but is not limited to, the following: • An end-user cybersecurity awareness program that requires annual training completion, monthly simulated phishing emails to assess user susceptibility and provide training on emerging threats, and ongoing awareness communications throughout the year to reinforce learnings and raise awareness of specific, actively exploited threat vectors; • Security policies and practices aligned with NIST Special Publication 800-171, Revision 2 (NIST 800-171 Rev 2) and the organization's enterprise risk management requirements; • Annual cybersecurity reporting and strategic update to ITT's Board of Directors; • Enterprise-wide centralized Security Information and Event Management (SIEM); • Regular red-team attack simulations led by industry-leading third-party cybersecurity firms; • Continuous internal and external facing vulnerability management scanning; • Threat intelligence feeds from various external sources (fee and non-fee based); • Threat hunting; • Strategically deployed artificial intelligence-based threat detection technology; • Cyber risk assessment and classification processes; • Cyber threat tabletop simulation exercises; • Cyber Incident Response Plan processes; • Externally led, targeted threat hunting exercises; • Engagement of forensic cybersecurity and data analysis firms (as needed) to conduct independent validation assessments if a breach is suspected and/or validated; • Engagements with third party consultants to build, design, and improve cyber risk management tools and processes; • Third-party technology and service provider risk evaluation process; and • Cybersecurity insurance coverage.

companyName: ITT INC.

ticker: ITT


text: The Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, the Company cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents.

companyName: Drilling Tools International Corp

ticker: DTI


text: The Audit Committee of the Allstate Board oversees the effectiveness of the cybersecurity program. The Audit Committee retains an external cybersecurity advisor to consult on cybersecurity matters and perform assessments of the Allstate Information Security Program (the "Program").

companyName: ALLSTATE CORP

ticker: ALL


text: Role: Day-to-day management of cybersecurity is handled by our IT staff, who do not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: Overall Risk Management The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure. These upgrades and/or replacements could adversely impact operations by imposing substantial capital expenditures, creating delays or outages, or experiencing difficulties transitioning to new systems. System disruptions, if not anticipated and appropriately mitigated, could adversely affect the Company. The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors. The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology consultants. Employees at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Role of Management We have established a management-level Risk Committee, that is led by the Chief Legal Officer, and also includes the Chief Information Officer and Chief Financial Officer, as well as certain of their respective Team Members. The Risk Committee meets on at least a quarterly basis to review enterprise risks, including with respect to cybersecurity, as applicable. Enterprise risks, including cybersecurity risk, are briefed to the Audit Committee on at least a quarterly basis by our Chief Legal Officer in coordination with the Senior Director of Cybersecurity and Chief Financial Officer, or through general updates. In addition, our cybersecurity team, led by the Chief Information Officer, works cross functionally with our legal and other business functions to provide cybersecurity training and, as appropriate, manage cybersecurity risks and incidents.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: An array of protective technologies have been implemented to detect and respond to indicators of malicious behavior before an incident ever takes place; however, should a cybersecurity incident occur, the Company has incident response and recovery procedures, which include determination of materiality and proper notification and reporting to the appropriate parties. These include legal and regulatory reporting requirements as well as notifications to impacted customers. The Company collaborates with peer financial institutions, local universities, threat intelligence organizations, third-party providers, law enforcement, and our customers to share tactical threat intelligence and best practices in protecting against emerging threats.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the U.S. Center for Internet Security ("CIS") and other applicable industry standards. Our defense-in-depth cybersecurity program is designed to focus on the following key areas: Collaboration

companyName: PGT Innovations, Inc.


text: The Board of Directors and its committees play an active role in overseeing our key enterprise level risks. Our Board, which annually reviews our enterprise risk management program, has delegated primary responsibility for overseeing the enterprise risk management program to the Audit and Finance Committee. The Board has delegated primary oversight of cybersecurity, a key enterprise risk, to the Cybersecurity Committee. The Board's Quality and Compliance Committee oversees and receives regular updates on data privacy, another key enterprise risk.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience at the Company and elsewhere, is responsible for developing and overseeing matters related to cybersecurity and reports directly to our CTO, who is accountable for the overall information technology and security strategy of the Company. The CISO receives reports on cybersecurity threats from several experienced information security professionals responsible for various parts of the business on an ongoing basis and, in conjunction with our enterprise risk steering committee, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO works closely with our legal department to oversee compliance with legal, regulatory and contractual security requirements. Our enterprise risk steering committee is comprised of key stakeholders throughout the Company and works with management and our CISO to (i) identify and review certain cybersecurity risks that we face, including the probability and impact of such risks, and (ii) identify steps needed to eliminate or mitigate such risks. In addition, we have a well-defined cybersecurity incident response plan, as described above. Finally, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the audit committee and the board of directors.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: The General Partner and the Trading Advisor maintain information technology systems, consisting of infrastructure, applications and communications networks to support the Partnership as well as its own business activities. These systems could be subject to security breaches such as 'cyber-crime' resulting in theft, a disruption in the Trading Advisor's ability to close out positions and the disclosure or corruption of sensitive and confidential information. Security breaches may also result in misappropriation of assets and could create significant financial and/or legal exposure for the Partnership. The General Partner and the Trading Advisor seek to mitigate attacks on their own systems but will not be able to control directly the risks to third-party systems to which it may connect. Any breach in security of the General Partner's or the Trading Advisor's systems could have a material adverse effect on the General Partner or the Trading Advisor and may cause the Partnership to suffer, among other things, financial loss, the disruption of its business, liability to third parties, regulatory intervention or reputational damage.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecutity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP


text: The Technology Steering Committee meets on a regular basis and is tasked with providing oversight and guidance regarding both information technology and cybersecurity related issues of strategic importance to the Bank. The Technology Steering Committee is comprised of numerous members of the management team, the CTO and the ISO. The Technology Steering committee reports to the Board of Directors through Committee minutes.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Eaton's Board of Directors is trained annually regarding incident response and risk management. While our Board of Directors as a whole has oversight of risk management generally, cybersecurity risks fall to the Board's Audit Committee. The Company's Chief Information Officer (CIO) and CISO report quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions. The Audit Committee also participates in risk management training related to cybersecurity risk management specifically.

companyName: Eaton Corp plc

ticker: ETN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: NEVRO CORP


text: We have adopted a Global Cybersecurity Incident Response Procedure that applies in the event of a cybersecurity threat or incident. These procedures include an incident response playbook which outlines the steps to be addressed in the event of a cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.

companyName: ESAB Corp

ticker: ESAB


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure We manage cybersecurity threats as part of our general risk mitigation, evaluation, and oversight processes. We implement our cybersecurity program internally through established policies, standards, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. We manage these risks to our employees, customers, stockholders, and business partners through a coordinated and consistent IT risk management process overseen by the Senior Manager, IT who assumes the role of our Chief Information Security Officer ("CISO").

companyName: Sonendo, Inc.

ticker: SONX


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. An analysis of the impact, likelihood, and management preparedness of cybersecurity threats to our strategic priorities is integrated into our enterprise risk management program and enterprise risk assessment process. This is intended to provide cross-functional visibility, as well as executive leadership oversight, to address and mitigate associated risks. Our internal IT group audits our information security programs, and the results are reported to our executive management and the Risk Committee of our Board of Directors by the Director of Information Technology. We also engage third party firms to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards. We further employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. We also carry cybersecurity insurance to protect against potential losses arising from a cybersecurity incident.

companyName: Calumet Specialty Products Partners, L.P.


text: Board Responsibilities On behalf of the Board of Directors, the Audit Committee provides oversight of the Company's management of cybersecurity risk. The Audit Committee quarterly reviews the Company's cybersecurity risks, incidents, audits, assessments, crisis readiness, awareness activities and compliance with cybersecurity and privacy laws and regulations. The Company's Chief Technology Officer briefs the Audit Committee quarterly on active and emerging cybersecurity threats and efforts to strengthen the Company's defenses against these threats.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Chief Technology Officer (CTO) is responsible for oversight of our cybersecurity risk management program. Our Vice President of Cyber Security (VPCS), who reports up to the CTO, is responsible for day-to-day assessment and management of cybersecurity risk.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Malware: Malicious software such as viruses, worms, trojans, and ransomware can infiltrate systems and disrupt operations, steal sensitive information, or extort money from the organization.

companyName: International Seaways, Inc.

ticker: INSW


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats, including any past cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition.

companyName: EQC Liquidating Trust


text: Each operating company assesses its own cybersecurity risk profile and designs and implements technical safeguards and other risk management policies; however, as one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program to which all operating companies are a part, includes: • Collaboration: Through ongoing communications with management and the Company's IT department, each operating company's IT department monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents applicable to the particular operating company in real time, and reports such threats and incidents to the Corporate Cyber Security Incident Team. • Technical Safeguards: Although each operating company assesses and implements its appropriate technical safeguards for its business, generally the Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats such safeguards are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident. The Company has adopted a Cybersecurity Incident Policy and has established a Corporate Cyber Security Incident Team to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. • Outside Consultants: The Company engages various outside consultants, including forensic specialists, public relations and data breach resolutions firms, outside attorneys and other third parties, to among other things, obtain information of a cybersecurity incident and isolate compromised systems and electronic data from further exposure; and determine and execute mitigation and remediation options and plans. • Education and Awareness: The Company provides awareness training to its personnel regarding cybersecurity threats to help identify, avoid and mitigate cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: The Vice President of Information Technology oversees the population of third-party service providers connected to any of the Company's networks. For each third-party service provider that would directly impact the Company's financial reporting, the Company obtains a System and Organization Controls (SOC) 1, Type 2 Report ("SOC 1 Report") to evaluate that service provider's internal controls and help the Company assess the risk of obtaining services from that services provider. The SOC-1 Report is reviewed by members of the Company's management and the Internal Audit group. The Company also limits access to information granted to any third-party service provider to only the information necessary for them to perform their services to the Company.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our cybersecurity risk management efforts are led by our Information Technology Director, who oversees our cybersecurity activities and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our ISMS. The Information Technology Director is part of the Company's Security Committee and reports to the Security Committee with respect to emerging cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. Our Security Committee, comprised of the Information Technology Director, the Chief Financial Officer, the Chief Legal Counsel and the Vice President of Human Resources is ultimately responsible for the implementation of our cybersecurity risk management processes. To facilitate effective oversight, our Security Committee holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging cybersecurity risks. The Security Committee has experience managing enterprises relying on technology and business systems with cybersecurity risks and consults with trusted advisors where appropriate.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: The information systems, data, assets, infrastructure, and computing environments of MPC's third-party service providers are also at risk of cybersecurity incidents. MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third-party risk assessment processes.

companyName: MPLX LP

ticker: MPLX


text: The Company's Board of Directors has ultimate oversight of cybersecurity-related risks and it is assisted in this role by the Technology Committee and the Audit & Risk Committee. Processes for identifying, assessing, and managing cybersecurity-related risks are integrated into the Company's overall enterprise risk management process, which is overseen by the Audit & Risk Committee. The Audit & Risk Committee is responsible for monitoring risks that are being taken by the Company, understanding the enterprise-wide effect of those risks and reporting such risks to the Board. In fulfilling this role, the Technology Committee has primary oversight responsibility over management's efforts to manage and mitigate cybersecurity-related risk and reviews and approves the Company's cybersecurity strategy for protecting the Company's information assets and technology platforms. The Audit & Risk Committee oversees the Company's outsourced Internal Audit Department, which conducts reviews and assessments related to information security. Management provides periodic reports to the Technology Committee and the Audit & Risk Committee, both of which provide reports of their meetings to the full Board. These reports to the Board and its Committees address the threat environment, vulnerability assessments, specific cyber incidents and management's efforts to monitor, detect and prevent cyber threats.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See "Risk Factors" for a discussion of cybersecurity risks, including, without limitation, the risk factor under the heading "We may be subject to security breaches or other cybersecurity incidents that could compromise our information and expose us to liability". Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: Our Chief Executive officer is the sole member of our Board of Directors, and he is responsible for oversight of cybersecurity risk. Our Chief Executive Officer, along with our President is responsible for the ongoing managing and assessing of our cybersecurity practices and reporting on such practices and risks. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our Company's size and scope.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: Our information security team is led by our VP of Information Technology and Security, who has decades of experience in information technology and cybersecurity. Furthermore, our VP of Information Technology and Security holds several certifications, including CISSP (Certified Information Systems Security Professional), ACCISO (Associate Certified Chief Information Security Officer) and CISM (Certified Information Security Manager). The information security team conducts periodic assessment and testing of our policies, standards, processes, and practices that are designed to address a multitude of potential cybersecurity threats and incidents. These efforts include a wide range of activities, including penetration testing, adoption and regular evaluation of incident response plans and procedures, regular team member email phishing test campaigns, email security monitoring, real-time vulnerability scanning and intrusion detection, team member cybersecurity awareness programming, regular audits & evaluations of internal and third-party systems, and continuous improvement of the information security management system.

companyName: INSEEGO CORP.

ticker: INSG


text: The Sr. Director, IT, in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Risks are evaluated with cross functional input using external guidance, risk matrices, governmental guidelines, and other cybersecurity best practices. This evaluation is shared with executive leadership via the ERM committee and through regular updates provided by the Sr. Director, IT.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Our CIO leads the information security organization which oversees the identification and management of information security risks. Our CIO has extensive information security and risk management experience in Information and Operational technology and holds the following information security certifications: Certified Information Systems Security Professional (CISSP); Certified Information Systems Auditor (CISA); and Certified Risk and Information Systems Control (CRISC).

companyName: W&T OFFSHORE INC

ticker: WTI


text: When a company purchases our service offerings, they gain a trusted digital advisor who will work together with them in efforts to protect customer data. We aim to provide the most secure and compliant enterprise cloud platform on the market and we work to build trust and in-depth defense into all of our systems. Among other things, we employ a diverse, experienced team of cybersecurity professionals, engage in community events and offer free online cybersecurity incident prevention training to enable our customers to focus on their business, knowing their data is safe and accessible as needed.

companyName: Salesforce, Inc.

ticker: CRM


text: To protect against unauthorized access, our identity and access management framework continues to evolve, incorporating multi-factor authentication and single sign-on to enhance access security. In parallel, our vulnerability management program is actively managed to identify, assess, and remediate security risks before they can be exploited. To further secure our infrastructure, we have deployed an advanced endpoint security solution, ensuring that all company devices are protected against malware and other cyber threats.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our cybersecurity incident response and vulnerability and patch management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO and General Counsel. Such management members work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: The Company's CIO reports directly to the Company's CEO and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.

companyName: LINDSAY CORP

ticker: LNN


text: Prior to the close of 2024, we intend to implement automated system restrictions over Information Assets that will permit general use of Low Risk Information Assets both internally and by our external business partners, and will restrict access to Medium and High Risk Information Assets to limited audiences with legitimate business purposes or specific job responsibilities. Additionally, we currently use confidentiality agreements before granting access as determined by relationship of the user and the associated risks of the Information Asset, and we periodically review access rights to ensure compliance and prevent unauthorized access.

companyName: Clene Inc.

ticker: CLNN


text: Cybersecurity Risk Assessment, Identification and Management We are committed to protecting our information technology ("IT") infrastructure, including computers, systems, corporate networks and sensitive data, from unauthorized access or attack. We have established global IT policies as well as IT security management control procedures designed to assess, identify, and manage material risks from cybersecurity threats, including but not limited to: Creating information security awareness among our employees and business partners and defining responsibilities among them; Implementing controls to identify IT risks and monitor the use of our systems and information resources; Establishing key policies and processes to adequately and timely respond to security threats;

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "If our security measures are compromised, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could result in a material adverse impact" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify significant cybersecurity risks to our critical systems, and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain critical service providers, suppliers and vendors based on our assessment of their criticality to our business and risk profile.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: As of December 31, 2023, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: GD Culture Group Ltd

ticker: GDC


text: Third-Party Service Providers. We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring, and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery.

companyName: RTX Corp

ticker: RTX


text: Our management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Global Net Lease, Inc.

ticker: GNL


text: Our CIO has over 28 years of experience leading our technology operations and more than 40 years of expertise in information technology, spanning the banking and fashion apparel industries. Our Global Director of Cybersecurity has over 20 years of experience in information technology, with a specialized focus of more than seven years in cybersecurity, risk management, and compliance. He holds Certified Information Systems Security Professional ("CISSP") and Certified Ethical Hacker ("CEH") credentials. Additionally, he serves as a governing body member for the New York Evanta CISO community.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Cybersecurity is one of several key risk categories that are evaluated and rated by the ERC on a quarterly basis. Each of our CISO, CIO, and VP, Enterprise Risk Management is a member of the ERC. The ERC reports periodically on its activities, findings, and areas of concern to the RMTIC. The RMTIC in turn reports to the Board on its oversight of cybersecurity risk.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Cybersecurity risks and the adequacy of associated mitigations are analyzed by senior leadership as part of the enterprise risk assessments that are reported to and discussed by our Board of Directors. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful incidents. For additional information on cybersecurity risks we face, see "Item 1A. Risk Factors", of this Annual Report, which should be read in conjunction with the foregoing information.

companyName: FLOWSERVE CORP

ticker: FLS


text: We are not aware of having experienced risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain potentially vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."

companyName: Woodward, Inc.

ticker: WWD


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Program Adjustments. The CIO monitors, evaluates, and adjusts the Cybersecurity Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: determine and execute mitigation and remediation options and plans; and ensure ongoing compliance with applicable legal and regulatory requirements, including notification to required individuals and regulatory bodies in the event of the discovery of an information security breach as defined under applicable laws, and timely and adequate disclosure under applicable SEC rules.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: The assessment process, internal tools, and corresponding SOC related services are also reviewed when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management shall determine whether additional risk management practices or controls are needed to maintain or augment the institution's cybersecurity maturity.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. In addition, we regularly engage third parties to perform assessments on our cybersecurity measures. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Champion Homes, Inc.

ticker: SKY


text: As of May 31, 2025, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.

companyName: PAYCHEX INC

ticker: PAYX


text: As of the date of this Annual Report on Form 10-K, cybersecurity threats have not materially affected and we believe are not reasonably likely to materially affect AMG, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. We have implemented policies to ensure we can control and monitor all devices that may have access to our protected information. We may engage external experts, including cybersecurity assessors, consultants and auditors, to evaluate cybersecurity measures and risk management processes as needed. Our Chief Financial Officer and President oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers

companyName: Nxu, Inc.

ticker: NXUR


text: Increased global cybersecurity vulnerabilities, threats and more sophisticated and targeted cyber-related attacks pose an ongoing risk to the security of our information systems and networks. Getty Images seeks to manage cybersecurity risks consistent with its general approach to enterprise risk management.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Company, whether at the board of directors or management level, does not currently have any processes in place for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Point of Care Nano-Technology, Inc.


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer ("CISO") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: In 2024, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Control. Identity and Access Management (IAM) allows us to manage access to our resources securely. IAM enables granular control over permissions, roles, and access policies, reducing the risk of unauthorized access.

companyName: AIRWA INC.

ticker: YYAI


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.

companyName: Five Point Holdings, LLC

ticker: FPH


text: The Risk & Technology Committee periodically reports to the Board of Directors regarding its activities, including those related to cybersecurity. As part of its oversight of major financial risk exposures, the Audit Committee also reviews with management and our internal and independent auditors our risk assessments and risk management program, including with respect to cybersecurity. Board members receive presentations on cybersecurity topics from our CISO or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a third-party CIO consulting firm and a managed services provider, which work together to provide wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity services, tools and training. An enterprise firewall; Implementation of Multi-Factor Authentication (MFA); Adherence to the Zero Trust model; Utilization of Managed Detection and Response (MDR); Endpoint Detection and Response (EDR) technologies;

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our Board of Directors and Audit Committee are primarily responsible for overseeing and governing our cybersecurity risk management program. Our Board receives updates on cybersecurity and material cybersecurity risks as needed and at least annually by our Chief Compliance Officer or their designee.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes regularly to review and align on IT strategic priorities, including the cybersecurity risk management program. This cross-functional approach ensures that cybersecurity efforts are integrated across the organization and that emerging risks are addressed proactively.

companyName: Karat Packaging Inc.

ticker: KRT


text: We have adopted a cybersecurity risk management framework designed to identify and mitigate potential cybersecurity risks, which is being integrated into our overall enterprise risk management program. Our risk assessments are informed by third-party cybersecurity experts, who conduct annual internal penetration tests and monthly vulnerability scans to continuously evaluate and strengthen our security posture.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: The Company is in the process of establishing a cybersecurity policy which implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Although the Company has combatted cybersecurity threats in the normal course of business, these threats have not materially affected its operations, business strategy, results of operations, or financial condition. While the Company strives to implement best-in-class cybersecurity measures, it recognizes that the threat landscape is continually evolving. Future attacks, if not successfully prevented or mitigated, could materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for additional information.

companyName: BUCKLE INC

ticker: BKE


text: Assessment, Identification and Management of Material Risks from Cybersecurity We have processes in place to assess, identify, and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy and policies implemented by the Adviser and HPS, the providers of our technology services. The Adviser manages our day-to-day operations and has implemented, together with HPS, a firm-wide cybersecurity program that applies to us and our operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by HPS, and (ii) any actions of the Adviser shall be deemed to refer to actions of HPS and/or the Adviser, as the context may require.

companyName: HPS Corporate Lending Fund


text: The Company also maintains a global incident response plan and regularly conducts exercises to help with our overall preparedness. The Company takes measures to improve and update our cybersecurity program, including independent third party assessments, penetration testing and scanning of our systems for vulnerabilities. The Company pairs with assessors, consultants, auditors, and other third-party service providers and advisers to assist in monitoring cybersecurity risks.

companyName: WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORP

ticker: WAB


text: The Board of Directors provides oversight and has designated primary responsibility to the Audit Committee who oversees our information security programs including cybersecurity and is actively involved in monitoring the progress of key cybersecurity initiatives. The CISO manages the cybersecurity program in collaboration with the CIO, CPO, and our business leaders. The CISO provides updates to the Audit Committee quarterly, including progress on the cybersecurity initiatives, risk trends and scores, and any cybersecurity incidents. Executive leadership and the Board of Directors are regularly informed and updated on any potentially material incidents.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced an increasing number of cybersecurity threats in recent years. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber attacks and other cybersecurity incidents pose threats to our technology systems and could materially adversely affect our business, operations, reputation or financial results." in Item 1A. Risk Factors.

companyName: ENBRIDGE INC

ticker: ENB


text: GECM also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.

companyName: Azitra, Inc.

ticker: AZTR


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K.

companyName: eHealth, Inc.

ticker: EHTH


text: Identification, Assessment, and Management of Third-Party Cybersecurity Risks We have designed our risk identification, assessment and management processes and procedures to account for cybersecurity risks associated with our use of third-party service providers. In addition to performing periodic assessments of vendors that include evaluating those vendors for cybersecurity risks, we endeavor to reduce supply chain cybersecurity risks by: (1) seeking to impose contractual requirements on our counterparties related to the use and security of personal data and other confidential information, as well as compliance with applicable privacy and security laws, wherever required by law to do so; and (2) requiring new software integrations and connectivity with vendors to undergo an architectural review process that involves consultation with the information security function and other relevant stakeholders. Moreover, critical vendors receive periodic comprehensive risk assessments conducted by the vendor management office (a team within the ERM organization), in collaboration with Information Security and our Business Resiliency Governance ("BRG") team, that include a focus on the vendor's cybersecurity practices.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: In the last three fiscal years, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: The governance, risk and compliance division of our Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the Company's most significant IT and cyber risks, the results of which are leveraged by the Company's IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: STORE CAPITAL LLC


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: scPharmaceuticals Inc.


text: The Company regularly assesses its financial exposure to cybersecurity risks and has contingency plans in place to mitigate these impacts.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity programs in order to mitigate risk and to safeguard the sensitive data collected, processed and stored by us. Our cybersecurity programs are guided in part by certain regulatory requirements (including payment network rules) that require periodic testing and external reviews. Cybersecurity is also one of the initiatives we have identified to guide our ongoing corporate sustainability efforts. Our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), has day-to-day responsibility for our cybersecurity programs. Due to the critical risks associated with cybersecurity incidents in the payment processing business, our cybersecurity programs are generally operated in a dedicated and independent manner.

companyName: Repay Holdings Corp

ticker: RPAY


text: In the last fiscal year, we have not identified any risks from known cybersecurity threats that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: Our board of directors has oversight responsibility for our overall enterprise risk management. The audit committee of the board of directors oversees cybersecurity risk, with input from our internal security committee, based on its oversight of our risk management processes. In accordance with our incident response plan, the internal security committee meets at least monthly, provides cybersecurity updates to the audit committee quarterly and apprises the full board of directors as needed.

companyName: Zscaler, Inc.

ticker: ZS


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from management and, where applicable, external experts, as part of our efforts to keep the Board updated on topics that impact similarly-sized biopharmaceutical public companies.

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning.

companyName: Apollo Infrastructure Co LLC


text: MPC's CISO is responsible for implementing the cybersecurity program which is comprised of Cybersecurity GRC (Governance, Risk & Compliance), Cybersecurity Architecture, Engineering & Operations, and a Cyber Fusion Center that includes Threat Intelligence, Vulnerability Management, & Incident Response. MPC's CISO has more than 30 years of experience in the oil and gas industry and has held various leadership and strategic roles across IT, software R&D and marketing, including collectively serving as a chief information security officer for seven years at two publicly traded companies. Its CISO also holds an Executive Master in Cybersecurity degree, a Master of Computer Science degree, and undergraduate degrees in both computer science and mathematics.

companyName: MPLX LP

ticker: MPLX


text: our cybersecurity program maturity is benchmarked annually against industry standards and norms. The result serves as a guide to identifying evolving risks, prioritizing improvements, and enhancing the program;

companyName: TE Connectivity plc

ticker: TEL


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: The Company's cybersecurity program also includes a cybersecurity training component. All employees are required to complete annual cybersecurity training focused on helping the workforce recognize cyber threats and scams, avoid falling victim to threats and scams, and report potential threats and scams. In addition, periodic cybersecurity awareness messages are posted on the Company portal.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and Company management and reports to the Company's Board of Directors and/or certain Board committees.

companyName: STURM RUGER & CO INC

ticker: RGR


text: We perform regular backups of critical systems, ensuring they are securely isolated from the production environment to safeguard against ransomware attacks. Additionally, our disaster recovery plans undergo routine testing of backups to ensure rapid and effective recovery when needed.

companyName: Health In Tech, Inc.

ticker: HIT


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Senior Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: Led by our CIO and CISO, we conduct regular assessments to identify potential cybersecurity risks and vulnerabilities, including the evaluation of systems and data assets. We have established internal procedures to stay vigilant against evolving threats by monitoring network traffic and conducting security audits. We also regularly engage independent assessors and external consultants who specialize in cybersecurity to conduct thorough, unbiased evaluations of our systems, policies, and procedures. These assessments help us ensure that our cybersecurity practices are aligned with applicable regulations and standards. To further evaluate our cybersecurity defenses, we periodically commission penetration exercises conducted by specialized firms. These tests simulate real-world attacks and assist in assessing our internal readiness and response capabilities.

companyName: DMC Global Inc.

ticker: BOOM


text: As part of our board refreshment efforts in recent years we have focused on adding trustees with cybersecurity risk management experience. Currently four members of our board of trustees have information security experience.

companyName: American Homes 4 Rent

ticker: AMH


text: We maintain processes for identifying, assessing, and managing material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K) as part of our broader enterprise risk management program under the oversight of the Audit Committee of the Company's Board of Directors. These processes include a wide variety of mechanisms, controls, technologies, systems, and methods that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting data. We also use systems and processes to oversee and identify risks from cybersecurity threats associated with our third-party service providers.

companyName: Xperi Inc.

ticker: XPER


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our business. These systems are managed, hosted, provided or used by third parties, to assist in conducting our business and which have their own cyber security measures in place. We implement generally applicable industry standards and best practices processes for the assessment, identification, and management of material risks from cybersecurity threats to our information technology systems. Our management team oversees our information security policies and procedures. Our maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Jacksam Corp

ticker: JKSM


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management committees and Bank Board. The Incident Response Plan is coordinated through the Chief Information Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Changes to material systems are governed by our change management processes. Certain systems are scanned for static and dynamic vulnerabilities. Automatic and manual penetration tests of certain environments are performed frequently and often through third-party testing groups.

companyName: Life360, Inc.

ticker: LIF


text: Management's role in assessing, monitoring, and managing our material cybersecurity risks is primarily the responsibility of our Global IT Manager, who reports to our CFO. Both the Global IT Manager and CFO rely on third-party experts, including consultants, and cybersecurity assessors. The Global IT Manager manages vendor work related to cybersecurity and is primarily responsible for the evolving cybersecurity processes and policies, remediating known risks and leading our employee training program, pursuant to which we provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene, incident reporting processes, and physical security practices.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Third-party vendors can present cybersecurity risks to the Company's technology resources. The Company has a vendor management team that provides oversight of third-party vendors and engages with the enterprise security team to assess potential cybersecurity risks related to a third-party vendor's services, both at the time of initial engagement and as part of an annual review process. The enterprise security team considers a number of factors in assessing such risks, including the types of services provided by the third-party vendor, the data and systems the third-party vendor needs to access to provide the services, and the policies and controls the third-party vendor has in place to mitigate cybersecurity risks. Some third-party vendors present a higher risk and require additional approval before a contract is signed or renewed. This ensures leadership is aware of risks posed by third-party vendors and can consider this information when evaluating contracts.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Innospec's cyber security is underpinned by a third-party specialist that monitors critical systems and end-user devices for cyber-attacks. In the first instance, cyber-attacks are brought to the attention of the IT leadership for evaluation and remediation before further escalation to the CEO and CFO is considered.

companyName: INNOSPEC INC.

ticker: IOSP


text: We consider our cybersecurity risk and related management processes when assessing risk across the Company. Our risk management systems and processes comprise numerous components, including policies and procedures, risk detection systems, tools and protocols, internal auditing, management review, defined lines of communications, cybersecurity awareness training for employees, phishing simulation tests, penetration testing, engagement of outside advisors and experts to assess, test or otherwise assist with aspects of our security controls, regular operations reviews with the CEO, and board (and audit committee) oversight. We use a number of means to assess and manage cyber risks related to our third-party service providers, such as conducting due diligence in connection with onboarding new vendors and legal review of vendor engagements and new products. We utilize the foregoing systems and processes to manage our risks and associated cybersecurity threats.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2024, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and reporting, data handling and provided targeted cybersecurity threat awareness and training to executives during 2024. The Company reviews its Incident Response plans and conducts tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: For the year ended September 30, 2024, Adient did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect Adient's business strategy, results of operations, or financial condition. For further information about the risks associated with cybersecurity incidents, refer to the cybersecurity risk factor in Item 1A, "Risk Factors" in this Form 10-K.

companyName: Adient plc

ticker: ADNT