text: Based on the information we have as of the date of this Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Kyndryl, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, s ee Item 1A. "Risk Factors."

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: CIM Group's personnel responsible for cybersecurity policy is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.

companyName: CIM REAL ESTATE FINANCE TRUST, INC.

ticker: CMRF

secItem: Item 1C


text: The Board receives prompt and timely information from the Bank's CISO on any cybersecurity or information security incident that may pose significant risk to the Bank and continues to receive regular reports on the incident until its conclusion. The Bank's Board receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the Board discusses cybersecurity and information security risks with the Bank's CIO and the Bank's CISO.

companyName: Federal Home Loan Bank of New York


text: Management's Role in Assessment and Management of Material Risks from Cybersecurity Threats We have an Information Security Committee (Infosec Committee) consisting of refining, renewable diesel, ethanol, logistics, and information services personnel that meets weekly to evaluate third-party exchange of data and collaborate on strategy for dealing with information security risks and other related matters. The Infosec Committee reports to our Information Security Oversight Committee (Infosec Oversight Committee) and our Executive Steering Committee on cybersecurity (Executive Steering Committee). Our Infosec Oversight Committee consists of information services, refining, and internal audit personnel and meets quarterly to discuss network threats and the overall security landscape. Our Executive Steering Committee consists of management within our information services, internal audit, refining, renewable diesel, ethanol, legal, and logistics teams, and meets twice per year to review and discuss information security metrics and results of security assessments, among other items. Key members of the Infosec Oversight Committee and the Executive Steering Committee provide a report to the Audit Committee of the Board as discussed above.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: The Company employes a defense and depth posture, designed to safeguard information, prevent unauthorized access, detect, and respond to threats, and maintain the confidentiality, integrity, and availability of data. The ISP establishes controls across many domains including but not limited to: Information Security Governance, Inventory and Control of Enterprise Assets and Software, Data Protection, Secure Configuration of Enterprise Assets and Software, Account and Access Control Management, Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, Application Software Security, Incident Response Management, and Penetration Testing.

companyName: Merchants Bancorp

ticker: MBIN


text: The Company employs a comprehensive, cross-departmental approach designed to continuously identify, assess, and mitigate potential cybersecurity risks. Our cybersecurity risk management program involves collaboration between our employees, the Information Technology ("IT") team, and the Information Security ("InfoSec") team, which is led by our Chief Information Security Officer ("CISO"). The Company's cybersecurity policies, standards, and processes are integrated into the Company's overall risk management program, and we regularly consider cybersecurity risks in the context of material risks to the Company.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: Our Information Security organization will be responsible for identifying the key responders for each security incident and maintaining engagement and communication throughout the incident lifecycle, which may include, among other things, containment, eradication, recovery, and a review of lessons learned. When necessary, the Information Security team will involve members of management and other representatives of our IT, Finance, Legal, and Internal Audit teams, with assistance of third-party consultants and outside legal counsel as appropriate, to assist in assessing the potential materiality of a cybersecurity incident. When necessary, these matters will be brought to the attention of the Audit Committee of the Board.

companyName: Revelyst, Inc.


text: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system. Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Information Officer (a seasoned executive with a degree in management information systems and decades of product and technology experience, including more than 20 years with the Company). The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks; evaluating and deploying appropriate security tools; and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents. The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Information Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.

companyName: COMSCORE, INC.

ticker: SCOR


text: We rely on digital technology to conduct our businesses and interact with customers, policyholders, agents, and vendors. With this reliance on technology comes the associated security risks from using today's communication technology and networks.

companyName: HCI Group, Inc.

ticker: HCI


text: The Enterprise Security Director, in collaboration with her team, is responsible for IT/OT cybersecurity, data security, and physical security. The Enterprise Security Director identifies, evaluates, and facilitates mitigation of cyber, data, and physical security risks and reports on cybersecurity matters and risks to the ERSC and the AOC. Our Enterprise Security Director has over 27 years of experience in IT/OT cybersecurity, data security and physical security, and is a certified information system security professional. She is also a member of numerous state and national cybersecurity organizations.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: We engage third parties and auditors to assess our cybersecurity program, including the use of select penetration testing and threat intelligence services, and to assist us in adopting and implementing best practices to improve our cybersecurity program. We have also retained third parties for cybersecurity incident response engagement in the event that a cybersecurity threat or incident requires capabilities beyond those of our own cybersecurity program. In addition, we have a third-party managed security operations center that provides 24/7 monitoring and alerting, threat intelligence, and posture recommendations. We are members of the Retail and Hospitality Information Sharing and Analysis Center, with more than 250 member companies from the retail, hospitality, and travel industries, which enables us to benchmark our cybersecurity risks, identify and adopt best practices for our cybersecurity program, subscribe to threat intelligence alerts, and contribute to the collective defense of our industries.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: Our full Board of Directors oversees the risk management process for the Company, which includes identifying, assessing and managing enterprise-level risks. The Board administers this oversight function directly through the Board of Directors as a whole, as well as through its standing committees that address risks inherent in their respective areas of oversight. The risk oversight responsibility of the Board of Directors and its committees is supported by the management reporting processes, which are designed to provide visibility to the Board of Directors and to the personnel who are responsible for risk assessment and information about the identification, assessment and management of critical risks, and management's risk mitigation strategies. Our cybersecurity risk program directly integrates and is intended to align with the Board of Directors' overall risk management process.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We also regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Cybersecurity Officer ("CCO"), who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: HARMONIC INC.

ticker: HLIT


text: IRadimed employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third-party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. Our cybersecurity team works in conjunction with the management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into IRadimed's enterprise risk management process, and our information technology leadership reviews the Company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into the enterprise risk management framework. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to, information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing, training and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources; and the formation of a multidisciplinary cybersecurity incident response team.

companyName: IRADIMED CORP

ticker: IRMD


text: Agilent is committed to maintaining a secure environment for our data, complying with applicable legal requirements, and effectively supporting our business objectives and customer needs. Our cybersecurity strategy emphasizes the cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention, detection of, and response to cybersecurity threats.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity-related risks.

companyName: HAEMONETICS CORP

ticker: HAE


text: Busey's cyber security risk management program includes administrative, technical, and physical safeguards to help ensure the security and confidentiality of customer records and information. Busey has long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: • Establishing an internal cybersecurity team that is responsible for conducting regular assessments of Busey's information systems, existing controls, vulnerabilities, and potential improvements; • Employing continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • Performing due diligence with respect to third-party service providers, including their cybersecurity practices, and requiring contractual commitments from Busey's service providers to take certain cybersecurity measures; • Ongoing monitoring and assessment of third-party vendors' cybersecurity practices, including regular audits, compliance checks, and incident reporting requirements; • Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in Busey's systems and processes; • Mandating periodic cybersecurity training for Busey's workforce, which includes awareness programs on phishing, social engineering, and other common cyber threats; • Implementing access control measures such as multi-factor authentication, role-based access controls, and regular access reviews to ensure that only authorized personnel have access to critical systems and data; • Using data encryption for both data at rest and data in transit to protect sensitive information; and • Creating an incident response plan that outlines the steps to contain, mitigate, and remediate the impact of cybersecurity incidents, including communication protocols and post-incident analysis.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: We have a multi-functional incident response plan which provides guidance in the event of a cybersecurity incident. The plan is managed by our Incident Management Team, which includes representation from our Global Security, Cybersecurity, Legal, and Finance departments, among others. The Incident Management Team is responsible for responding to an incident, including tasks such as identifying and assessing the nature of the incident, containing the incident, and coordinating with relevant departments. Depending on the nature or severity of the event, the Incident Management Team may escalate the matter to our Executive Leadership Team, which includes the Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel, and other executives. If necessary, the matter could be escalated to our Board of Directors or any appropriate Board committees. This structured governance approach is designed to manage cybersecurity incidents with participation and involvement with the appropriate levels of our organization.

companyName: HERBALIFE LTD.

ticker: HLF


text: Brunswick's leadership recognizes the importance of information security and managing cybersecurity risks across the enterprise. We manage our global business operations through a variety of systems for commercial transactions, customer interactions, manufacturing, branding, employee tracking, and other applications. Systems based on legacy technology, sometimes added through acquisitions or hosted by third parties, and/or that contain personal information of customers or employees, present risks of erroneous or fraudulent transactions, disclosure of personal, sensitive, and confidential information, loss of reputation and confidence, potential impacts on our operations, and may result in legal claims or proceedings, penalties, and remediation costs. Our mature cybersecurity program has been strategically designed to assess, identify, and manage these cyber risks, protect the organization, respond to, and recover from cybersecurity incidents.

companyName: BRUNSWICK CORP

ticker: BC


text: Ultimate responsibility for risk oversight and management generally lies with the Company's Board. To effectively manage oversight of our cybersecurity risk management practices, the Board has delegated such responsibility to the Company's Audit Committee. The Company's Chief Information Officer ("CIO") and the information security team provide reports to either the Audit Committee or the full Board on a quarterly basis on various matters, including current and emerging cybersecurity risks to the Company, internal and external assessments of the Company's information security program, and a roadmap of projects to manage its information security posture. In the event of any significant cybersecurity incidents, the Company's Incident Response Plan outlines the process to escalate communications to the Audit Committee and/or the full Board in the event of any significant cybersecurity incidents between the quarterly updates on an ad hoc basis.

companyName: Uniti Group LLC


text: Our management team remains actively engaged in overseeing cybersecurity risk prevention, detection, mitigation, and remediation efforts. This is achieved through regular briefings from our internal IT and cyber staff, with insights from threat intelligence sources, including governmental, public, and private entities as well as guidance from external service providers. Additionally, management reviews alerts and reports generated by advanced security tools deployed within our environment to ensure a proactive and informed approach to cybersecurity threats.

companyName: Oklo Inc.

ticker: OKLO


text: At the executive and management level, the Chief Administration Officer, via delegations to the Cyber Security organization, is authorized to govern and functionally oversee our security controls and services on behalf of the enterprise. Our cybersecurity organization, under the direction of the CISO who reports to the CIO, implements and provides governance and functional oversight for cybersecurity controls and services, including coordination with our Corporate Security function. Our CIO has over 20 years of experience with information systems, including management roles in operational security, technical design and engineering, and platform architecture cybersecurity, governance and compliance, and business continuity. Our CISO has over 20 years of experience in cybersecurity, governance and compliance, physical security and business continuity. In addition, cybersecurity risk is assessed and tracked through the Company's enterprise risk management program.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President of Technology, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Traeger, Inc.

ticker: COOK


text: We depend on a variety of information systems and technologies (including cloud technologies) (collectively, "IT Systems") to manage our business. We rely on these IT Systems to provide information for substantially all of our business operations, including supply chain, order processing, e-commerce, human resources, legal, compliance, marketing, finance, and accounting. Our core IT Systems consist mostly of purchased and licensed software programs that integrate together and with our internally developed solutions. As part of our overall enterprise risk management program, we monitor and assess the risks posed by cybersecurity threats to those internal and external systems and solutions and maintain an information security program designed to mitigate such risks.

companyName: Dorman Products, Inc.

ticker: DORM


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security. This training and compliance program functions to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Mersana Therapeutics, Inc.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls, and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: 5&2 Studios, Inc.


text: Our cybersecurity incident response policy and procedures are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Members of management and other technical experts will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.

companyName: Akili, Inc.


text: We maintain a comprehensive cybersecurity program that encompasses our enterprise information technology, including operational technology and technology of third parties on which we rely, and connected products and services. Our enterprise cybersecurity program is guided by the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. Key areas of responsibility in the program include governance, risk and compliance, threat analysis and response, security architecture and engineering, security operations and secure manufacturing operations. Our connected products and services cybersecurity program is guided by the ISA/IEC 62443 standard. Key areas of responsibility include product security, software development, innovation management, threat analysis and incident response. Both the enterprise and connected products and services programs are designed to assess, identify and manage risks from cybersecurity threats in order to protect and preserve the security, resiliency, integrity and continued availability of the Company's information technology systems and connected products and services, and also to protect the confidentiality and integrity of information owned by, or in the custody and care of, the Company. Elements of the programs include policies, standards, architecture, processes, tools, technology, employee education and training, and incident response. Our enterprise and product security programs undergo regular testing, including periodic vulnerability scanning and penetration testing. In addition, we also periodically engage third parties to assess our enterprise and product security programs and provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks.

companyName: Xylem Inc.

ticker: XYL


text: A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; awareness training of our employees, incident response personnel, and senior management; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Company and other products, subsidiaries, and affiliates of TIAA.

companyName: Nuveen Global Cities REIT, Inc.


text: Our cybersecurity risk committee, which includes employees with responsibility for information technology, information security, operations, finance and legal matters, has oversight of the cybersecurity program which manages our cybersecurity threats and risks. Members of this committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including: • using automated and manual tools for identifying threats; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments; • evaluating threats reported to us; • conducting scans of the threat environment; • conducting internal and external audits; • analyzing reports of threats and actors; • evaluating our and our industry's risk profile; • subscribing to reports and services that identify cybersecurity threats; and • utilizing third-party threat assessments.

companyName: MANNKIND CORP

ticker: MNKD


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have not yet implemented a formal cybersecurity risk management program designed to identify, assess and mitigate risks from cybersecurity threats to this data, our systems and business operations. We intend to implement a cybersecurity risk management program before the end of 2024.

companyName: bowmo, Inc.


text: Management, in coordination with our IT department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: collaboration with third-party cybersecurity experts who perform periodic penetration testing, vulnerability assessments, and other procedures to pinpoint potential weaknesses in our systems and processes; and regular cybersecurity training sessions for our staff.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Assessing, Identifying, and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things, ongoing security awareness training for employees, mechanisms to detect and monitor unusual network activity, and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: The pace of change in approaches undertaken by cyber criminals requires an approach to security that strives for continuous improvement and constant monitoring of the landscape. While we are working to adopt the cybersecurity framework of the National Institute of Standards and Technology (NIST), we believe continued investment through parties external to our information technology team is the best means for extensively testing both the design and operational effectiveness of our cybersecurity controls, and ensuring their level of priority as compared to our other information technology objectives, namely system continuity and functionality.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: We also engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability and penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the ERC, who reports such results to the Board as appropriate, and we tailor our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Ameris Bancorp

ticker: ABCB


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties provide external expertise in all aspects of our cybersecurity program and assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee (IT Committee), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires these parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.

companyName: Great Elm Group, Inc.

ticker: GEG


text: As mentioned, the Company's Information Security Officer is primarily responsible for managing and updating the information security program. The responsibilities for managing the information security program include cybersecurity risk assessment, assessing the types and appropriateness implemented controls and coordinating related control testing, coordinating user training with each department and the appropriateness, data storage and maintenance, incident response, and third-party risk management. Specifically, the information technology department, as a whole, consists of information security professionals with varying degrees of education and experience with senior management in department having higher professional education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, the Company's Information Security Officer and Chief Information Officer have relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: CITY HOLDING CO

ticker: CHCO


text: As discussed above, these members of management report to the Risk Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters.

companyName: GREEN DOT CORP

ticker: GDOT


text: Comprised of leaders from various departments with a goal of providing high-level oversight and strategic direction for cybersecurity initiatives, the Cybersecurity Leadership Team strives to align cyber risk management with the overall business strategy and ensure resources are allocated appropriately. Members include employees from various operational perspectives and departments including IT, Finance, Legal, Product Development, Marketing, and People Management to foster a holistic approach to cybersecurity.

companyName: Snap One Holdings Corp.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity risk management team is led by our VP IT Security Compliance and our Head of IT. These individuals have collectively over 50 years of experience in both restaurant and technology sectors and have held technology leadership roles at national restaurant companies.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: The Company continuously monitors its information systems to proactively assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. The Company's process for identifying and assessing material risks from cybersecurity threats operates alongside the Company's broader overall risk assessment process. The Company's Computer Security Incident Response Team immediately investigates system alerts that may indicate the presence of a cybersecurity threat or incident and escalates information regarding the threat or incident as necessary to address it in a timely manner. The Company also maintains a computer security incident response plan with formalized workflows and playbooks. The computer security incident response plan, among other things, provides for inter-departmental coordination and management of cybersecurity threats or incidents to quickly assess the impact, mitigate risks to information systems, and work to resolve vulnerabilities. We periodically conduct simulation exercises involving employees at various levels of the organization. We also periodically engage external partners to conduct annual audits of our systems, test our systems infrastructure, and suggest improvements. Through these channels and others, we work to proactively identify potential vulnerabilities in our information security system. Senior management meets regularly with the Company's risk-management team and internal and external auditors to evaluate the effectiveness of the Company's systems, controls, and management processes with respect to cybersecurity risks. The results of key assessments are reported in summary to the Board of Directors periodically.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: In the normal course of business, we collect and store personal information and other sensitive information, including proprietary and confidential business information, intellectual property, information regarding patients and clinical trial participants, sensitive third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impac ts. We establish incidence response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. No risks from cybersecurity threats have occurred that have affected our business strategy, results of operations, or financial condition.

companyName: CORCEPT THERAPEUTICS INC

ticker: CORT


text: Under the oversight of the Board of Directors (since we do not currently have an Audit Committee), we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process.

companyName: Accredited Solutions, Inc.

ticker: ASII


text: The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Third-Party Service Provider Oversight: Our oversight processes include comprehensive due diligence checks for any new third-party service provider and continuous monitoring of our existing managed service provider and CIO firms' activities. We have established protocols for communication and incident response that align with our managed service provider's operations, and industry best practice, ensuring swift action in the face of cybersecurity threats. Furthermore, a scheduled series of meetings has been established to procure updates and deliberate upon cybersecurity strategy with our contracted third-party providers.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: When reviewing key third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third-party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's risks associated with cybersecurity, its cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity program.

companyName: Metsera, Inc.


text: Genworth's CISO and CRO, both members of management, support the cybersecurity risk oversight responsibilities of the Board and the risk committee and involve applicable management personnel in cybersecurity risk management. The risk committee receives periodic reports from the CISO and CRO on the Company's technology and cybersecurity risk profiles, information security program and key cybersecurity initiatives. Additionally, the CISO and CRO follow a risk-based escalation process to notify the risk committee outside of the regular reporting cycle when they identify potential substantive cybersecurity risks or issues.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach, where applicable.

companyName: Vigil Neuroscience, Inc.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management. The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: To ensure the continuance of our operations in the event of a cybersecurity incident or threat, we have established an Information Security Policy and Security Incident Response Plan, and have adopted a business continuity management program.

companyName: Federal Home Loan Bank of Des Moines


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"). The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: External Assessments – We engage external assessors to evaluate, test, and conclude on the design and effectiveness of security controls and processes. We engage quality assessors for vulnerability and penetration testing as well as for security certification and/or regulatory requirements. Further, we have external audits performed by customers, banking and government regulators, and public accounting firms as part of financial and statutory audit purposes. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on security and cybersecurity threats we face, please see "Risk Factors."

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: The Company maintains Cybersecurity Incident Response Guidelines and Procedures to assist in response to real or suspected security incidents. The Incident Response Guidelines prescribe points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors and regulatory bodies.

companyName: TFS Financial CORP

ticker: TFSL


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not be materially affected by such risks or a material incident in the future, or that we have not experienced an undetected cybersecurity incident. As discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to the Company, including potentially to our results of operations and financial condition. See "Risk Factors — Our systems, networks and online business activities and those of third parties that we utilize in our operations are subject to cybersecurity and stability risks, information technology system failures, and security breaches."

companyName: Xperi Inc.

ticker: XPER


text: Risks from Cyber Threats Like many businesses, the Bank faces numerous cybersecurity risks in connection with providing services to our customers. Guaranty does not currently believe that any current or previous risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect the Bank, including its business strategy, results of operations, or financial condition. Unfortunately, the sophistication of cyber threats continues to increase, and the Bank's cybersecurity risk management and strategy may be insufficient or may not be successful in protecting against all cyber incidents. No cybersecurity program will be able to anticipate all cyber threats and breach attempts, and there may exist limitations to the ability to effectively implement preventive measures against such breaches in a timely manner. For more information on how cybersecurity risk may materially affect the Bank's business strategy, results of operations or financial condition, please refer to "Item 1A. Risk Factors."

companyName: GUARANTY BANCSHARES INC /TX/


text: management and strategy engage and implement risk management strategies to identify, assess, and manage material risks arising from cybersecurity threats and alerts. Our method involves a systematic evaluation of all potential threats, vulnerabilities, and their possible impacts on the Company's operations, data, and system integrity. Our cybersecurity risk management strategy includes: Identifying risks to our environment; Deploying Internal IT teams and third-party providers to investigate, contain, and resolve identified threats; Providing monthly cybersecurity awareness training to our staff; Maintenance and periodic testing of a cybersecurity incident response plan;

companyName: INTERGROUP CORP

ticker: INTG


text: Employee Training and Technology-Based Safeguards We provide annual data protection and cybersecurity training for all personnel, including full-time, part-time, and temporary staff. This program covers topics such as: Social engineering and phishing awareness, Password protection and mobile security, and Incident response and reporting.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Describe management's role in assessing and managing the registrant's material risks from cybersecurity threats. In providing such disclosure, a registrant should address, as applicable, the following non-exclusive list of disclosure items: Whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members in such detail as necessary to fully describe the nature of the expertise. Relevant expertise may include, for example, prior work experience in cybersecurity; any relevant degrees or certifications; any knowledge, skills or other background in cybersecurity.

companyName: Energy & Water Development Corp

ticker: EAWD


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology Cybersecurity Framework to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.

companyName: GRIFFON CORP

ticker: GFF


text: Our Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function based on their respective areas of expertise. Our Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Audit Committee and the Aerospace Safety Committee, and each committee reports on its activities and findings to the full Board after each meeting. The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. Our Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO) and our Chief Security Officer (CSO) provide presentations to the Audit Committee on cybersecurity risks at each of its bimonthly meetings. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. In addition, the Audit Committee has designated one of its members with expertise in cyber risk management to meet regularly with management and review our cybersecurity strategy and key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee is notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate. The Aerospace Safety Committee provides oversight of the risks from cybersecurity threats related to our aerospace products and services. The Aerospace Safety Committee receives regular updates and reports from senior management, including the Chief Engineer, the Chief Aerospace Safety Officer, and the Chief Product Security Engineer, who provide briefings on significant cybersecurity threats or incidents that may pose a risk to the safe operation of our aerospace products. Both committees brief the full Board on cybersecurity matters discussed during committee meetings, and the CIO provides annual briefings to the Board on information technology and data analytics related matters, including cybersecurity.

companyName: BOEING CO

ticker: BA


text: Managing technology risks, including cybersecurity risks, is a fundamental part of the Corporation's risk management framework and processes. The Corporation employs a variety of processes, risk assessments, and controls to assess, identify, and manage these risks. This includes estimating the likelihood and potential impact of cybersecurity incidents. To manage these risks, the Corporation designs, documents, and implements controls, which are then tested through compliance assessments and internal and external audits. In some cases, the Corporation also transfers risk, either wholly or partially, through insurance and other methods. When an incident occurs, the Corporation responds by remediating the incident while complying with regulatory obligations, and then evaluates the remediation's effectiveness. Communication about risk management matters is conducted through documented policies and procedures, management and Board committee reporting, and employee training and communications. For a detailed description of how cybersecurity risks may materially affect the Corporation's business strategy or results, see "Item 1A. Risk Factors."

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose.

companyName: DT Cloud Acquisition Corp


text: Our Cybersecurity Program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit and Risk Committee of the Board of Directors. We also actively engage with key vendors, industry participants and threat intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of the Cybersecurity Program.

companyName: Bioventus Inc.

ticker: BVS


text: In early 2024, Standard BioTools completed a merger with SomaLogic Operating Co, Inc. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities persist, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: At this time, we have not identified any risks from known previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. With a majority of our business in energy and infrastructure, we face sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents could occur in the future. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, technology disruptions and failures, and our reliance on technology.

companyName: Northwest Natural Holding Co

ticker: NWN


text: Identification of risks is a multifaceted process, encompassing diverse activities such as management self-disclosure, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third-party service providers/vendors. The Technology Risk Management practice operates as a continuous model assessment, utilizing information gathered daily, weekly, monthly, and annually to provide insights into the state of controlled risk within the organization. Security testing and assurance activities may be outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: In order to identify, assess, protect, detect, respond to and recover from cybersecurity threats, we seek to employ multiple industry best practices, processes and controls to minimize the personal information in our possession, including pseudonymization, anonymization, tokenization and encryption. In addition, the Company maintains technical and organizational measures to ensure that personal information is accessible only by authorized personnel. In the event of a data breach, the Company is committed to notifying impacted customers and/or appropriate government entities in accordance with applicable law without unreasonable delay and in all events within the time period specified by applicable law.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Reporting to Management and Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.

companyName: Flywire Corp

ticker: FLYW


text: We are not aware of any previous cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.

companyName: HMN FINANCIAL INC


text: For a description of the risks from cybersecurity threats that may materially affect us and how those threats may do so, see our risk factors under Part 1. Item 1A. "Risk Factors - If our information technology systems or data, or those maintained on our behalf, are or were compromised, this could result in a Material Adverse Impact."

companyName: aTYR PHARMA INC

ticker: ATYR


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and training and certification such as Digital Directors Network, Qualified Technical Expert training and certification, National Association of Corporate Directors (NACD) certification, Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and BCS certification, as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Typically, we (i) perform periodic tabletop exercises with a company-wide cross-functional team that are facilitated by a third-party expert and are intended to simulate a real-life security incident, (ii) conduct penetration testing as needed and annually conduct Payment Card Industry Data Security Standard testing and firewall reviews, and have periodically engaged a third-party expert to help therewith, (iii) hold annual cybersecurity awareness trainings, and (iv) periodically engage a third-party expert to conduct a review of our information security framework, which is designed to help identify existing and emerging risks, and mitigate against such risks. These internal efforts and external third-party reviews also support our efforts to regularly assess our information security program and framework against emerging risks, market and industry developments and provide opportunities to make adjustments or enhancements when deemed prudent or necessary. In 2024, we established a company-wide cross-functional team to preliminarily assess the risks and opportunities from conventional and generative AI and will continue these assessments in 2025. To date, there have been no cybersecurity incidents that have materially affected us, or that are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Markel Ventures requires real-time reporting of cybersecurity incidents to understand how the matters are being managed, assess whether public disclosure is required, with escalation to Markel Group senior management as warranted by the severity of the situation. Depending on the cybersecurity incident, third parties may be engaged by the Markel Ventures businesses to assist them in understanding and managing the event.

companyName: MARKEL GROUP INC.

ticker: MKL


text: Our Vice President of Information Technology & Corporate Facilities has served in this role since 2018, and has more than 25 years of experience in various roles involving managing information security, technology infrastructure and IT operations.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We have aligned our cybersecurity program with recognized security frameworks such as NIST-CSF (National Institute of Standard and Technologies – CyberSecurity Framework). We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Murphy has not experienced any material impacts to our business, operations, or reputation due to cyberattacks or other security-related incidents. However, we recognize cyber threats are constantly evolving and are committed to cultivating a culture of security, remaining vigilant and continually improving our cybersecurity environment and controls.

companyName: MURPHY OIL CORP

ticker: MUR


text: The Company emphasizes the importance of security awareness to our workforce through the administration of third-party cybersecurity training and prioritizes the monitoring and prevention of unauthorized access to Company information technology ("IT") assets such as networks, computers, mobile devices, applications, and stored information. Our internal IT team considers cybersecurity capabilities of third-party service providers prior to engaging them and on an ongoing basis. Our key external IT vendors provide the Company with system and organizational control reports that are reviewed by our internal IT team and may reveal potential security risks.

companyName: FreightCar America, Inc.

ticker: RAIL


text: Monitoring of Cybersecurity Incidents Our Cybersecurity Incident Response Plan establishes how we monitor and respond to cybersecurity incidents impacting our environment. The CISO works closely with members of our Executive Leadership Team and his cybersecurity team to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. We engage a third-party managed security services provider (MSSP) to provide 24/7 continuous monitoring of the Company's IT and operational technology environments for potential cybersecurity incidents. In the event such an incident is identified by our MSSP or any of our employees, our cybersecurity team assigns it a severity classification and escalates the incident accordingly. Depending on the severity of the incident, certain key personnel are notified and work together to further investigate the incident and take actions to respond, which may include engaging with external specialists, regulatory authorities and our cybersecurity insurance carrier. The CISO receives regular updates on all incidents and incident responses, which the CISO shares with our Executive Leadership Team on a weekly basis. Our cybersecurity team conducts a post-incident review of all major cybersecurity incidents, which review includes identification of vulnerabilities, assessment of the incident's impact on the Company and recommendations to help prevent similar incidents in the future. See "Item 1A. Risk Factors" for a more detailed description of the cybersecurity risks we face.

companyName: ENTEGRIS INC

ticker: ENTG


text: Board Governance and Oversight We involve multiple levels of oversight as a part of our approach to cybersecurity risk management.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Based on an assessment using the previously described cybersecurity risk management process, we do not believe that there are any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Our business and operations may be materially adversely affected in the event of information technology system failures or security breaches, and the costs and consequences of implementing data protection measures could be significant." in Part I, Item 1A. "Risk Factors" for additional information.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: Monitor Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents and is subject to periodic testing for effectiveness of response and remediation.


text: Cybersecurity Risks As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we previously have and anticipate we will continue to face risks associated with cybersecurity incidents. Although we make efforts to maintain the security and integrity of our networks and systems, and the sensitive information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident, although the amount of coverage may not be sufficient or provide applicable coverage for a given incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: We regularly evaluate and adjust our information security procedures by integrating emerging technologies, revised frameworks and industry best practices. In addition, we require all employees to undertake mandatory annual training covering information security, social engineering, remote working, phishing and email security and digital threats, among others. Additionally, we maintain internal informational content consisting of educational material on cyber awareness on our Company portals and conduct ongoing simulated phishing exercises.

companyName: PRA GROUP INC

ticker: PRAA


text: Our audit committee of the board of directors is responsible for overseeing the guidelines and policies governing the process by which the Company assesses and manages our exposure to risk, including cybersecurity risk, as well as any major litigation, regulatory, financial and reputational risk exposures and the steps management has taken to monitor and control such exposures. This oversight is achieved through a combination of periodic management reports, focused briefings on emerging cyber threats and vulnerabilities, updates on implemented mitigation strategies and periodic reviews of incident response plans.

companyName: Perella Weinberg Partners

ticker: PWP


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity events or incidents. Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, or data.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Impact of Risks from Cybersecurity Threats We do not believe that any of the risks from cybersecurity threats we have faced to date have materially affected, or currently viewed as reasonably likely to materially affect, the Company, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity threats cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity threats in the future. For a description of the risks from cybersecurity threats that may materially affect us, including our results of operations and financial condition, see Item 1A. Risk Factors – We are subject to information technology systems failures, security breaches, loss or leakage of data, technological malfunctions or other disruptions, which could result in, among other things, material disruption of our product development programs, financial losses, the inability to process transactions, the unauthorized release of confidential information and reputational risk, restrictions on accessing critical information and potential exposure to liability, all of which would negatively impact our business, financial condition or results of operations.

companyName: Liquidia Corp

ticker: LQDA


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program is designed to meet cybersecurity, privacy, regulatory and compliance obligations, by managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and must demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.

companyName: PTC INC.

ticker: PTC


text: Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats.

companyName: Nakamoto Inc.

ticker: NAKA


text: Our CISO has been with Wyndham since 2012 and has worked in the cybersecurity industry for over 20 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010 and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Commercial Officer, Chief Compliance Officer and Chief Financial Officer and Head of Strategy, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size, taking into account our operations and risks.

companyName: W. P. Carey Inc.

ticker: WPC


text: We developed and maintain our program as required by applicable laws and regulations, including without limitation Cybersecurity Maturity Model Certification (CMMC) and 17 CFR Part 229.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Governance and Management's Responsibilities Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities, and has delegated responsibility for oversight of this risk to the audit committee. The audit committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our audit committee oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional program that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FULLER H B CO

ticker: FUL


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. The CEO and CFO report on cybersecurity matters, including material risks and threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Our CISO organization is responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting policies for the management and oversight of risk. The organization monitors cyber regulation requirements, reviews impacts of new products and initiatives, conduct reviews of cyber assessments and testing activities and provides effective challenge to the FLOD risk management activities.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: MPC manages third-party service provider cybersecurity risks through contract management, evaluation of applicable security control assessments, and third party risk assessment processes.

companyName: MPLX LP

ticker: MPLX


text: The Company has robust processes for assessing, identifying and managing material risks from cybersecurity threats that are integrated into our overall risk management process. The Company utilizes the National Institute of Standards and Technology (NIST) framework as the basis for our cybersecurity management approach. Under the supervision of the Chief Information Officer ("CIO"), we review our cybersecurity insurance policy and regularly identify all computing assets including hardware, software, and network infrastructure for a comprehensive risk assessment. We consider threats that may originate from both internal and external sources and build in technical security controls based on a defense-in-depth strategy. To identify risks, we complete vulnerability assessments on a recurring basis to proactively identify potential weaknesses. We additionally employ third party external and internal penetration testing on an annual basis to assist in identifying additional vulnerabilities in our environment. We also perform disaster recovery exercises throughout the organization annually by our in-house team. In connection with our threat management and overall risk management process, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors and apply the MITRE ATT&CK framework to review defensive coverage against cybersecurity attacks. Employees at H&E receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. Our managed detection and response partner provides 24/7 monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. A cybersecurity incident is defined as any successful unauthorized access, disclosure, or misuse of computing systems, data or networks, including hacking and theft, of any scope that may or may not have an impact to the organization. We have a comprehensive incident response plan that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents. As of December 31, 2024, risks from cybersecurity threats have not materially affected the Company's financial condition or operations.

companyName: H&E Equipment Services, Inc.


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Board has appointed a Chief Information Security Officer. Together with the Risk and Audit Manager, they provide direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: In addition, where appropriate, we seek to include in contractual arrangements with certain of our third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit, and test such vendors' cybersecurity programs and practices. We also utilize a number of digital controls to monitor and manage third-party access to internal systems and data.

companyName: Invitation Homes Inc.

ticker: INVH


text: While we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents, as of the date of this report, we are not aware of any cybersecurity incidents that have had or are reasonably likely to have a material impact on our business or operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors in the risk factor entitled "Disruption of critical information technology systems, infrastructure and data or cyberattacks or other security breaches or incidents could harm our business and financial condition."

companyName: ACCURAY INC

ticker: ARAY


text: Our management team periodically participates in the review of our cybersecurity systems, processes, threats and incidents with our internal cybersecurity team, including the controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology and reports to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: Operationally, the Company maintains Security and Network Operations Centers, which provide 24/7 coverage and support of on-call cybersecurity and network professionals to triage and respond to immediate cybersecurity threats and outages. The Company also assesses cybersecurity risks on a quarterly basis and ranks them according to their risk profile. These risks are communicated to management and to the Board of Directors as part of the normal course of operations.

companyName: TUCOWS INC /PA/

ticker: TCX


text: Disaster Recovery Plan – our Disaster Recovery Plan is documented to provide guidance and outline processes used to recover or continue operations of critical IT infrastructure, and systems in the event of natural or human disasters.

companyName: Six Flags Entertainment Corp/OLD


text: The IT Security Team consists of five members, led by the VP of IT of the Company's CoreCard Software subsidiary, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.

companyName: CoreCard Corp

ticker: CCRD


text: As of the date of this report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation and cause existing Independent Business Partners (IBPs or distributors) / customers to discontinue, as well as prevent us from attracting new clients / customers. and / or subject us to third-party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition. We currently do not carry a cyber liability insurance policy, but are evaluating whether to acquire one to mitigate any financial impact of a cybersecurity breach.

companyName: Stemtech Corp

ticker: STEK


text: Due to the our size, our information technology ("IT") environment does not utilize overly complicated systems or processes. We do not sell products or conduct business in an online environment and our primary transactional activity is done through partnerships with oil and gas operators and other investment managers. We utilize a third party managed services provider ("Provider") for security applications, monitoring, and updates to our information technology environment. The Chief Financial Officer serves as the relationship manager for and has regularly scheduled meetings with the Provider to evaluate whether the services provided meet our needs, review hardware and software obsolescence, and identify any new threats that need to be addressed. We use multi-factor authentication for applications wherever possible to provide access security and we maintain a secure physical environment. We also engage a separate third-party vendor to provide staff IT security education, testing for social engineering vulnerabilities, and reporting on employee training.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: The Program's security and risk policies and standards, implemented by either the Company or third party assessors or consultants, include: –information security management tools, such as firewalls, intrusion prevention and detection systems, anti-malware functionality, and access privilege controls; –vulnerability management, including penetration and control testing and vulnerability scans of information systems; –incident monitoring, breach notification and escalation, including disaster recovery and incident response plans and resources; –risk based assessment of third party service providers; and –annual cybersecurity awareness training for employees and contractors.

companyName: BERKLEY W R CORP

ticker: WRB


text: While cybersecurity incidents have not materially affected the Company or our business strategy, results of operations, or financial condition to date, no assurance can be provided that we will not be subject to a significant cybersecurity incident in the future. See "Item 1A. Risk Factors—Industry and Market Risks—Our business could be adversely affected by events outside of our control, including armed conflicts, war, terrorist attacks or threats, pandemics, natural disasters, cyber-based attacks, or other significant events." for additional information on our cybersecurity risks.

companyName: Talen Energy Corp

ticker: TLN


text: At the management level, our Director of Information Technology who is experienced in experienced cybersecurity matters, leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our Director of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our Director of Information Technology reports to our CFO/COO and to our CEO.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats, including for example threat intelligence service providers, penetration testing firms, dark web monitoring services, cybersecurity consultants and software providers.

companyName: NGM BIOPHARMACEUTICALS INC


text: We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents, which have capabilities to automatically isolate and terminate vulnerabilities. We utilize industry leading tools and controls for user management, authentication, and privileged access management.

companyName: JBG SMITH Properties

ticker: JBGS


text: The Audit Committee receives quarterly reports from the Chief Information Officer ("CIO") on our cybersecurity risks. In addition, the CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, which is part of our global information security policy.

companyName: LCI INDUSTRIES

ticker: LCII


text: We rely on information technology and data to operate our business and develop, market and deliver our services to our customers. Our information technology includes various cloud computing resources, computer networks, third party hosted services, communications systems, software, and our data (which includes confidential, personal, proprietary and sensitive data) (collectively "Information Assets"). We maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business.

companyName: Grindr Inc.

ticker: GRND


text: The Risk Committee, Audit Committee, and the Board of Directors are active in understanding and evaluating cybersecurity risks. The Risk Committee receives and reviews a quarterly Enterprise Risk Management ("ERM") report from the Chief Risk Officer that is the cumulation of a process that involves discussions with leaders across the Company and incorporates a number of enterprise risk factors, including those related to cybersecurity threats. The Audit Committee receives the results of internal and external penetration testing as well as any other audits applicable to the Company's information security programs. The Audit Committee actively engages management in discussions surrounding the outcome of these audits.

companyName: BROOKLINE BANCORP INC


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the Information Security Program described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: GREEN DOT CORP

ticker: GDOT


text: We have developed and regularly test our business continuity and disaster recovery plans to ensure a swift recovery in the event of a cybersecurity incident. This includes regular backups, redundant systems, and an established communication protocol.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, computer hardware and software, and our critical data includes proprietary, confidential and sensitive data, including, without limitation, personal data (such as health-related data), intellectual property and trade secrets (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Members of our management team, including our Chief Executive Officer (CEO), CFO, and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN