text: Our risk-based assessment and management of material risks from cybersecurity threats are integrated into NetScout's overall risk management processes. Cybersecurity risks are addressed as a component of NetScout's enterprise risk management program and our enterprise risk management processes include an Enterprise Risk Management Steering Committee ("Steering Committee"), led by the CCO and includes all members of the Council as well as other members of management, that meets quarterly and considers ways to mitigate cybersecurity threats that are more likely to lead to a material impact to our business. The Steering Committee evaluates material risks from cybersecurity threats against our overall business objectives and provides a risk register report to the Audit Committee of the Board of Directors, which evaluates our overall enterprise risk.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Encryption and Data Protection Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information and other confidential data. We also have a program in place to monitor our retained data by identifying PII and ensuring it is not stored outside of approved locations and systems. We maintain policies that govern the deletion of PII to limit the information exposed to a potential cyberattack. We have endeavored to use strong, up-to-date encryption algorithms and to regularly update and patch systems in an effort to guard against vulnerabilities. Similarly, we have sought to manage encryption keys with use of a secure key management system and rotation of keys after use. We have implemented secure protocols, including, e.g., hypertext transfer protocol secure for web traffic and secure file transfer protocol for file transfers.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI

secItem: Item 1C


text: We consult with external parties, such as third-party cybersecurity firms, to provide, among other things, monitoring of systems, threat intelligence, and employee cybersecurity training. We also use third parties to assist our risk management processes by conducting security assessments.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Company's management team is responsible for the oversight and administration of cybersecurity protocols. Our management team relies on our third-party providers for administrating cybersecurity assessments to identify, manage, mitigate, and respond to cybersecurity threats. Management updates the Board on any significant cybersecurity occurrences. The Board receives periodic briefings on cybersecurity risks, incidents, and risk mitigation measures, and reviews management's cybersecurity policies and response plans at last annually.

companyName: PORTSMOUTH SQUARE INC

ticker: PRSI


text: See the section titled Item IA. Risk Factors, including "If our information technology systems, or those of third parties with whom we work, or our data are or were compromised or operate in an unintended way, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences", for additional information about the risks from cybersecurity threats that may materially affect our business.

companyName: Asana, Inc.

ticker: ASAN


text: The above cybersecurity risk management processes are integrated into our overall risk management program. In addition to our efforts to continually evaluate our cybersecurity program and cybersecurity risks based upon emerging threats as a part of our risk management processes, cybersecurity risks to the Company are evaluated periodically through internal audits and annually by independent consultants, and we seek to incorporate learnings into our overall risk matrices.

companyName: HF Sinclair Corp

ticker: DINO


text: We have several employee training and development programs that are designed to, among others, raise awareness of cybersecurity risks impacting the business to encourage consideration and facilitate managing those risks. To assess the effectiveness of our program, we periodically conduct penetration testing and other vulnerability analyses. As part of the assessment of the protections we have in place to mitigate risks, we engage third parties to conduct risk assessments on our systems.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • periodically evaluate customer support interactions to help ensure compliance with security protocols and service standards; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Board of Directors The Audit Committee of the Company's Board of Directors (the "Board") is responsible for overseeing the Company's cyber risk. Management has established a process for the Audit Committee to receive regular updates that encompass a broad range of topics, including: Current cybersecurity threat landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from unique cybersecurity events, including those of other companies; Compliance status and efforts with regulatory requirements and industry standards; Regulatory updates; Vulnerability developments; and Other cyber risk topics as requested by the Board.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: We have established agreements with these third parties for hardware, software, telecommunications, and other information technology services essential to our business operations. Additionally, we collaborate with third-party business partners and operators who have their own cybersecurity risk management procedures and tools. Our entire Board of Directors with our senior officers monitor cybersecurity of the date of this filing, we are not aware of any cybersecurity threats that have materially affected our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed.

companyName: AMERICAN BATTERY MATERIALS, INC.

ticker: BLTH


text: Wiley adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), as a guide for its cybersecurity program to establish, and maintain a continuous improvement process for identifying, assessing, and managing cyber risks and cyber-related threats. The framework's key domains of identify, protect, detect, respond, recover and governance encompass specific controls to be established and maintained by an organization. Wiley's controls are monitored and tested on a continuous basis by an external third-party to assess the effectiveness of our cyber program.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Important to these programs is Invesco's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco DB Multi-Sector Commodity Trust


text: As part of the Company's risk management framework, risk management programs and processes are in place to incorporate risk considerations into day-to-day business activities across the Company's risk categories, business lines, and functions. Risk programs may manage all or certain components of a particular risk type. The Company's cybersecurity risk program provides centralized planning and management of related and interdependent work with a focus on risks from cybersecurity threats. The Company's cybersecurity risk program is integrated into the Company's overall business and operational strategies and requires that the Company allocate appropriate resources to maintain the program.

companyName: US BANCORP \DE\

ticker: USB


text: Xencor's head of IT has 33 years of experience and has managed information technology in complex environments for 20 years. In coordination with senior management, including the CFO, the head of IT works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. Cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents support the success of our cybersecurity program. Ongoing communications with these teams are designed to keep the head of IT and senior management informed about the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Xencor Inc

ticker: XNCR


text: CSC's Board of Directors, supported by the Board Risk Committee, oversees Schwab's enterprise risk management process and policies, including cybersecurity risks. Integrated within the Company's overall enterprise risk management program, Schwab has an established information security program that is regularly assessed against formal industry standards and knits together complementary tools, controls, and technologies to protect systems, client accounts, and data. We deploy advanced monitoring systems to identify suspicious activity and deter unauthorized access by internal or external actors, and work collaboratively with government agencies, law enforcement, and other financial institutions to address potential threats. We evaluate and manage risk related to third-party vendors, assessing their cybersecurity programs and practices both prior to onboarding and over the term of service. We also maintain policies, standards, and procedures, which apply to employees, contractors, and third parties, regarding the standard of care expected with all of our data, whether the data is internal company information, employee information, or non-public client information. This includes limiting the number of employees who have access to clients' personal information and internal authentication measures enforced to protect against the unauthorized use of employee credentials. Employees who handle sensitive information are trained in privacy and security, including training on recognizing social engineering. Schwab also engages with external firms specializing in discrete areas of cybersecurity to assess the Company's practices, vulnerabilities, and overall cyber risk posture.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections of our risk factors titled "Risks Related to the Use of Technology" and "Legal and Regulatory Risks."

companyName: Sprout Social, Inc.

ticker: SPT


text: Cybersecurity Incidents Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three fiscal years, we have not experienced any material information security breach incidences and the expenses we have incurred from information security breach incidences were immaterial. This includes penalties and settlements, of which there were none.

companyName: International Seaways, Inc.

ticker: INSW


text: To continually manage and control the material risks that cybersecurity threats present to the organization, Alternus invests significantly in the cybersecurity elements outlined above.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our cyber security consultants operate a remote monitoring and management system which enables continuous monitoring of IT components, provides IT maintenance, and installs and maintains security and recovery capabilities including: patch management, antivirus, cloud data back up, and mobile device management.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: We have adopted a cybersecurity incident reporting process ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for response. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board of Directors and other key stakeholders informed and involved as appropriate.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.

companyName: IMAX CORP

ticker: IMAX


text: As part of our overall cybersecurity strategy, as and when we detect cybersecurity threats, our Information Security Team documents the relevant incident details, assesses the impact and severity of it, identifies the root cause and corrective actions, and communicates the incident to our CISO and any other relevant parties as needed. We also seek to address cybersecurity risks associated with our third-party vendors by making our Information Security Team a key part of relevant vendor onboarding, whereby we conduct comprehensive risk assessments of such vendors' cybersecurity policies and practices. When necessary, we utilize third party auditors and consultants to assess third-party cybersecurity risks, and we consult with outside counsel as appropriate, including on materiality analysis and disclosure matters. Our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: Acceptance of current payment options also subjects us to rules, regulations, contractual obligations and compliance requirements which may change over time or be reinterpreted, making compliance even more difficult, costly or uncertain. We cannot guarantee that our financial results will not be negatively impacted by complying with these requirements.

companyName: PROCYON CORP


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • internal resources who are responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect, alert on, respond to, and help mitigate cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments, and other procedures which identify potential weaknesses in our systems and help validate and improve internal processes and tooling; and • periodic cybersecurity training for our workforce.

companyName: HBT Financial, Inc.

ticker: HBT


text: Incident Response Plan (IRP). In our effort to ensure that information security incidents can be recovered from quickly and with the least impact to The Corporation and its customers, The Corporation maintains a structured and systematic IRP for all information security incidents that affect any of the IT systems, network, or data of The Corporation, including The Corporation's data held, or IT services provided by third-party vendors or other service providers. The VP IT and the ISO are responsible for implementing and maintaining the IRP, which includes: • Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training to employees and board of directors. • Reviewing the IRP at least annually, or whenever there is a material change in The Corporation's business practices that may reasonably affect its cyber incident response procedures.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Cybersecurity and Technology Risk Management Committee of the Board of Directors (the "Cybersecurity Committee") oversight of cybersecurity and other information technology risks. The Cybersecurity Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Our Cybersecurity Compliance and Disclosure Committee ("CCDC"), which is further described below, is chaired by our CIO and includes the General Counsel and the CPO of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company's data security, privacy, and artificial intelligence policies and procedures. The CCDC regularly enlists internal and external subject matter experts to assist where necessary.

companyName: Gold.com, Inc.

ticker: GOLD


text: The ISO and other information systems staff possess in-depth knowledge and experience which are instrumental in developing and executing our cybersecurity strategies. The ISO and the Tech Steering Committee oversee our governance programs, work with our technology-focused leaders and partners to align security and compliance, and have developed our employee security awareness training program.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: Many of the Company's IT systems operate with a hosted architecture or by third-party service providers, and if these third-party IT environments fail to operate properly, our systems could stop functioning for a period of time, which could put our users at risk. Accordingly, we are dependent on the operations of IT service providers. Our vendor management process, which includes due diligence steps prior to selecting third party service providers, is an important part of our risk mitigation strategy. In particular, we require ISO and other security compliance for all critical vendors by contract. Additionally, the Company monitors risks from cybersecurity threats associated with the user of third-party service providers and will audit critical vendors for compliance, as appropriate. Notwithstanding, if there is a catastrophic event, such as a natural disaster or other adverse weather condition, terrorist attack, security breach, or other extraordinary event, the Company, and our service providers, may be unable to operate business as usual, or at all, for the duration of the event and/or a time thereafter.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are based on the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.

companyName: Blueprint Medicines Corp


text: Our CIO leads an internal IT Security Committee that meets regularly to oversee company-wide efforts to address cybersecurity threats, to assess the effectiveness of our information security program and to prioritize efforts to improve our security measures and planning. Our IT Security Committee includes members of our IT security function and executive management of our legal, finance and internal audit/risk, human resources and corporate communications and technology functions.

companyName: Gentherm Inc

ticker: THRM


text: We have a security incident response framework in place. This is part of the process we employ to inform our management and Board of Directors about and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments of our policies and standards in relation to applicable state and federal statutes and regulations.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: NEVRO CORP


text: First Guaranty has developed and implemented an Incident Response Plan (IRP). The IRP establishes a framework for the information security team to identify, classify, notify, contain, eradicate, and recover from cybersecurity related incidents. Testing of the IRP is conducted annually.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: We maintain cybersecurity policies and procedures as part of our overall risk management process. We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments which are designed to identify, assess, and manage cybersecurity risks. We perform cybersecurity risk analyses of select third-party service providers and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. We did not experience any material cybersecurity threats or incidents for the year ended December 31, 2024.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: Global Technology and Business Unit management are also responsible for implementing internal controls to manage risks from cybersecurity threats to an appropriate level and in line with the firm's risk appetite. Cybersecurity risks are managed across all lines of business, requiring support and participation across all levels in the organization. Within Global Technology, Enterprise Security is responsible for maintaining security policies, standards, and guidelines and routinely works with our Enterprise Risk, Compliance, Internal Audit, and other key technology and corporate stakeholders to establish security controls, enforce them, and monitor their adherence on an ongoing basis. Enterprise Security also conducts regular phishing tests and manages annual employee training focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats. Business Continuity and Disaster Recovery programs execute regular testing across business and technology teams to demonstrate resilience. The CISO regularly reviews the cybersecurity program and strategy with various risk committees, including the ERMC, Management Committee, and the Audit Committee. This ensures risks from cybersecurity threats are properly managed and our enterprise-wide cybersecurity program is aligned with the business needs and defined risk tolerances or risk appetite.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's Board of Directors (BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC"). • Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks. • Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls; perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention; tabletop exercises, ongoing vulnerability and patch management; vendor due diligence; multi-factor authentication; device encryption; application security, code testing and penetration testing; endpoint security, including anti-malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges; employee awareness, training, and phishing testing; data loss prevention program and monitoring; information security incident reporting and monitoring; and layered and comprehensive access controls. • Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis. • Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of risk assessment and risk management, including cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: We have a program in place designed to detect and respond to cybersecurity incidents. Our Chief Information Security Officer ("CISO") and the cybersecurity team are responsible for defining, implementing and administering appropriate measures to protect information across the Company. Cybersecurity risks are also identified and considered when conducting our annual Enterprise Risk Management ("ERM") exercise. Pursuant to our ERM program, material cybersecurity risks are identified, assigned to an individual owner with the organization, reviewed twice annually with the CISO, Chief Legal Officer and Corporate Secretary, and Chief Information Officer and tracked to evaluate containment and mitigation efforts on a go-forward basis. As further described below, management also reviews and discusses the ERM program with the Audit & Finance Committee ("AFC") of our Board of Directors ("Board"), as well as the full Board, at least annually.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, have developed cybersecurity measures for our technology platform that include a variety of safety measures. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat, creating the possibility of future events. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from the Vice President of Technology and third-party service providers.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO") through our Information Security Committee ("ISC"), which includes a cross-functional group of senior leaders who are responsible for the dissemination and promotion of our cybersecurity strategy, implementation of cybersecurity objectives and top-down communication and monitoring of the risk management program as described above. Our ISC is responsible for the regular oversight of cybersecurity risk, information security and technology risk and assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Security Incident Reporting Our security incident reporting policy and procedures enable the identification, monitoring, reporting, and response capabilities to known or suspected security incidents in our network and all IT-managed services and Information Systems. Security identification begins with a broad range of potential risks, including, but not limited to, theft or unauthorized disclosure of Information Assets, unexpected modification of Company Information Assets, disruptions of service that can result in Information Assets being unavailable for an unacceptable amount of time, and suspicious behavior and/or unauthorized activity by any individual or organization that can potentially compromise Information Assets or Information Systems.

companyName: Clene Inc.

ticker: CLNN


text: We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board of Directors and our Audit Committee, along with our executive management. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC).

companyName: A10 Networks, Inc.

ticker: ATEN


text: Unitil Corporation's Board of Directors (the "Board") is responsible for oversight of the Company's ERM program, including risks from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. The Company's management generally provides the Board with updates on and assessments of ongoing and emerging risks from cybersecurity threats at regularly scheduled Board meetings.

companyName: UNITIL CORP

ticker: UTL


text: The Company places a high priority on safeguarding its data, systems, and infrastructure from cybersecurity threats. To manage this critical aspect of operations, the Company partners with a third-party IT provider that specializes in cybersecurity services. Established in 1997, this provider brings over two decades of expertise in managing and mitigating cyber risks, including network security, vulnerability assessments, and incident response planning. The provider's comprehensive approach ensures the protection of the Company's sensitive information and critical systems, while also adhering to industry best practices and regulatory requirements. By leveraging the expertise of its third-party IT provider, the Company is able to implement robust cybersecurity measures that support operational continuity and reduce exposure to potential security incidents.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: TMC the metals Co Inc.

ticker: TMC


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LENSAR, Inc.

ticker: LNSR


text: Our CISO, in coordination with our Chief Information Officer ("CIO") to whom the CISO reports, leads our approach to assessing and managing cybersecurity-related risks. Our CISO has over thirty years of experience in IT, with twenty years in information security, as well as a background in software engineering and in leading security engineering teams, technical services and support teams, and sales engineering teams. Our CIO has over 20 years of experience with information technology and cyber security and a background in software engineering. Our CIO has served in lead cyber security roles at global public companies and holds a CISA certification from the Information Systems Audit and Control Association.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: The members of our Cybersecurity Team have various levels of experience in information technology and cybersecurity matters. Our third-party technology firm is a global information technology and cybersecurity provider with a seasoned executive team possessing decades of experience and various cybersecurity certifications, such as Certified Information Systems Security Professional certification. Our CCO and CFO each has extensive experience managing risks at the Company, including risks arising from cybersecurity threats. Our CCO also holds a CERT Certificate in Cybersecurity Oversight issued from the CERT Division of the Software Engineering Institute at Carnegie Mellon University and the National Association of Corporate Directors.

companyName: Granite Point Mortgage Trust Inc.

ticker: GPMT


text: As part of our overall risk management program, we provide required training to consultants and employees in high risk areas on cybersecurity. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of our contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our technology development programs," "Our proprietary information, or that of our customers, suppliers and business partners, may be lost or we may suffer security breaches," and "Failure of our information technology systems could significantly disrupt the operation of our business.

companyName: Enertopia Corp.

ticker: ENRT


text: We use certain cloud-based third-party vendors for the core trading systems of certain of our exchanges and certain of our governance products and solutions. Prior to engaging such vendors, we analyze each provider's SOC2 certifications and perform due diligence and testing for information security and interoperability with our systems, and annually review the SOC2 certifications. Our security assurance and threat assessment team, within our Information Security organization, collaborates with our external threat intelligence providers to proactively review Nasdaq, and our vendors with respect to emerging threats and associated risks.

companyName: NASDAQ, INC.

ticker: NDAQ


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. We utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, assess and manage our cybersecurity risks, including third-party risks. Our risk assessment involves analyzing and minimizing risk associated with outsourcing to third-party vendors or service providers. We continue to evaluate and enhance our systems, controls, and processes where possible, including responses to actual or perceived threats specific to us or experienced by other third-party vendors or service providers.

companyName: TEAM INC

ticker: TISI


text: Management's Roles and Responsibilities Operational responsibility for cybersecurity falls to the management, led by the IT department. The management team is tasked with executing our cybersecurity strategy, focusing on risk assessment, incident prevention, and response. This includes conducting vulnerability assessments, ensuring continuous monitoring, and staying updated on cybersecurity trends and threats. The Software Engineer, with extensive experience in information security, works in close coordination with other key management roles to ensure a unified approach to cybersecurity across our company.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: As of the date of this report, we have not identified any cybersecurity threats, including any past cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, financial condition, or results of operations. We continue to monitor cybersecurity risks closely and remain committed to taking proactive measures to address evolving threats.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on an annual basis, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide specialized security training for certain employee roles, such as application developers. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network/endpoint protection, monitoring and response; • Vulnerability management and • Backup and recovery testing.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Through 2024, the RLI Corp. Board of Directors provided oversight for cybersecurity risks primarily through its Audit Committee. In February 2025, the charter of the Finance & Investments Committee was revised to include overall enterprise risk management oversight, including oversight of cybersecurity risk. The committee was renamed the Finance & Risk Committee (FRC). The Company's CIO, along with the head of the Company's IT security department, presents quarterly to the designated committee on cybersecurity risks and the Company's strategies to assess and manage those risks. Additionally, the board receives periodic updates on emerging cybersecurity issues and developments through director education provided by the Company and third-party experts, detailed reviews provided by the CIO and the Company's head of IT security on select cybersecurity topics, and periodic "table top" simulations of a cybersecurity event.

companyName: RLI CORP

ticker: RLI


text: Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data intrusions, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Advisor's cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents and (3) containing, eradicating, recovering from and reporting cybersecurity events.

companyName: Net Lease Office Properties

ticker: NLOP


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security leads the Company's cybersecurity efforts under the direct oversight of our Chief Technology Officer. Together, these individuals have over 50 years of experience involving information technology, including security, auditing, compliance, systems and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: BBSI has integrated cybersecurity risk management into our overall risk management framework to identify, assess, and manage cybersecurity risks. As part of our integrated risk management process, our technology and information security team work closely with our management team on an ongoing basis to identify and respond to cybersecurity threats. Our proactive approach to cybersecurity risk management includes cybersecurity risk assessments performed internally by our IT security team and externally by third-party experts, penetration and vulnerability testing using third-party vendors and tools, tabletop exercises that simulate cybersecurity incidents, cybersecurity awareness training, and internal audit assessments of critical IT controls.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: CTO's Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President, Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect CTO's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with written information security incident response plans adopted by CTO and the Company. These members of CTO's management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support, including cybersecurity consultants, in evaluating, monitoring and testing our cyber management systems and related cyber risks. Our collaboration with these third parties includes audits, threat and vulnerability assessments, company-wide monitoring of cybersecurity risks and consultation on security enhancements.

companyName: LGI Homes, Inc.

ticker: LGIH


text: As discussed in more detail under the heading "Governance" below, our board of directors' oversight of cybersecurity risk management is supported by our Senior Vice President of Information Technology, who leads our cybersecurity team, which is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and ensuring our compliance.

companyName: STORE CAPITAL LLC


text: Management Governance The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Cyber Oversight Group, led by our CITO and VP, Information Security and Compliance. Our CITO leverages his decades of experience as an IT professional with significant expertise in enterprise architecture, engineering, analytics and digital technology. In addition, our VP, Information Security and Compliance has over 20 years of experience as a Chief Information Security Officer in multiple industries and has received Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC) certifications. Our CITO and VP, Information Security and Compliance are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm, founded in San Francisco in 1992, with $222 billion of assets under management (as of December 31, 2023) and investment and operational teams around the world. TPG invests across a broadly diversified set of strategies, including private equity, impact, credit, real estate and market solutions. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations. As part of its collective risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG also uses the NIST Cybersecurity Framework to assess our cybersecurity controls. TPG stores data, including ours, in cloud environments with security that we believe is appropriate for the data involved, and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, and Vulnerability Management.

companyName: Arcellx, Inc.

ticker: ACLX


text: As of May 31, 2024, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, and financial condition. We continue to invest in cyber-resilience and cyber-threat response preparedness as we anticipate ongoing risks from cybersecurity threats. Refer to the "Risk Factors" section contained in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.

companyName: PAYCHEX INC

ticker: PAYX


text: The full Board of Directors of MPLX GP oversees enterprise-level risks and has delegated to the Audit Committee of the MPLX GP Board oversight of risks from cybersecurity threats as informed through MPC's ERM program. MPC's CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The MPC CDO and CISO are responsible for managing risks from cybersecurity threats. The CDO and CISO provide regular cybersecurity briefings to the MPLX GP Board of Directors including the MPLX GP Audit Committee, with a minimum of two briefings per year and additional briefings as needed. The MPLX GP Audit Committee also has direct access to the CDO and CISO and their management teams for other updates on cybersecurity and information security strategy throughout the year. Additionally, the CDO and CISO, from time to time, meet with members of management to discuss cybersecurity risks, strategy, and threats.

companyName: MPLX LP

ticker: MPLX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and sixteen years as a corporate privacy and security officer, as well as our Vice President, Manufacturing and Commercial Operations and Information Technology.

companyName: NeuroPace Inc

ticker: NPCE


text: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.

companyName: Kayne DL 2021, Inc.


text: The operation of our business is dependent on the secure functioning our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: We depend on integrated information systems to conduct our business. In order to defend against cybersecurity threats, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The frameworks used to design and assess our program include the National Institute of Standards and Technology Cybersecurity Framework and Sarbanes Oxley. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We have an IT Steering Committee ("ITSC") made up of cross-disciplinary senior management, including (among others) the Head of IT, Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer, along with IT leadership and representatives from several additional departments. The ITSC meets at least quarterly to oversee our IT risk management framework, including information security, data privacy, and regulatory compliance. It monitors the effectiveness of controls, reviews incident reports and provides guidance on mitigating emerging IT risks and vulnerabilities that are more likely to lead to a material impact to our business. The ITSC investigates incidents and reports its findings to our senior management, which, depending on the severity of the incident, may be reported to our audit committee or board.

companyName: ACELYRIN, Inc.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - If we, or our vendors, partners or customers, experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."

companyName: Seer, Inc.

ticker: SEER


text: Lead IT Systems Specialist Depending upon the type of incident or event, representatives from other areas of the Company (e.g., senior executives such as our Chief Financial Officer and Chief Executive Officer, Legal/Compliance, Corporate Security, Internal Audit, Human Resources, Directors of Banking and Mortgage, Corporate Communications) may be included on any of these teams from time to time for a particular investigation/response.

companyName: CapStar Financial Holdings, Inc.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Cyber-attacks or other security breaches could adversely affect our operations, net income or reputation" in Item 1A. Risk Factors.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: ASGN's data protection and cybersecurity governance structure enables transparency and visibility to key stakeholders: the Company's Board and its Strategy and Technology and Audit Committees, and the Company's Chief Executive Officer. The Board's Strategy and Technology Committee focuses on technology and cybersecurity, while the Board's Audit Committee reviews data security breaches or other issues. Each committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Company's chief information officers across our brands ("CIOs") and external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ASGN Inc

ticker: ASGN


text: The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.

companyName: Steele Creek Capital Corp


text: Information technology (IT) is critical to many of our operating activities and is subject to security threats and increasingly sophisticated cyber-attacks. As a result, we have policies and processes in place to assess, identify, and manage the strategic and operational IT-related risks as an integrated part of our overall risk management system.

companyName: XMax Inc.

ticker: XWIN


text: To more effectively share information and gain consensus regarding cybersecurity initiatives and prevention policies, the Company has in place an Enterprise Risk Management Committee consisting of various members of LP senior leadership including the Chief Legal Counsel and Chief Financial Officer. The Enterprise Risk Management Committee is chaired by our Chief Tax Officer. The ISO, along with her team, is responsible for leading an enterprise-wide information security strategy, including policy, standards, architecture, processes, and security technology. The Enterprise Risk Management Committee (i) meets quarterly and as-needed to review and discuss the Company's risks, including cybersecurity threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's cybersecurity program and the emerging threat landscape and (ii) reports risks related to any material cybersecurity incidents, as needed, to the Board of Directors and the Finance and Audit Committee (FAC) of the Board of Directors.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: Our enterprise risk management framework considers cybersecurity risk in conjunction with our other Company risks as part of the overall risk assessment process. Our enterprise risk management team collaborates with the cybersecurity function, led by the Chief Information Security Officer ("CISO"), to gather their insights and risk mitigation strategies for managing cybersecurity threats. This integrated approach helps us assess, identify, and manage cybersecurity risks along with our other operational, financial and strategic risks, assisting in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: Our CISO reports to our Chief Information Officer, who meets with our Audit Committee at least annually to discuss cybersecurity risk and related issues. These meetings may encompass a broad range of topics, including: • cybersecurity initiatives and strategies, • cybersecurity events, • emerging threats, • regulatory requirements, and • industry standards.

companyName: FLUOR CORP

ticker: FLR


text: We also provide employees with policies and training in areas such as ethics, information security, social engineering, data protection, and compliance, and with regular updates on the cybersecurity program and potential threats.

companyName: OneStream, Inc.

ticker: OS


text: The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Stereotaxis, Inc.

ticker: STXS


text: As a part of its information security program, the Company addresses cyber risks posed by its relationships with third-party service and application providers. The Company assesses third parties as a part of the procurement process, including through pre-acquisition diligence. Contractual provisions based on regulatory requirements and industry standards are used in the contracting process, and the Company conducts on-going performance monitoring of key vendors. Security audits are also performed on certain vendors to review compliance with contractual requirements and industry standards.

companyName: KEMPER Corp

ticker: KMPR


text: As one of the critical elements of Apollo ' s overall ERM approach, Apollo ' s cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo ' s risks, including its cybersecurity risks. Apollo ' s Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd. ("AHL"), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: requiring employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. Our cybersecurity risk management program is a key component of our overall risk management process, and includes similar characteristics, reporting channels and governance processes to those that apply across other legal, compliance, strategic, operational and financial risk areas within the Company.

companyName: Nuvalent, Inc.

ticker: NUVL


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: The Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: The Cigna Group's dedicated cybersecurity team is led by our GCISO. Our current GCISO joined Cigna in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team at The Cigna Group, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brand, and oversaw the security of a global payment network, a corporate network and digital assets.

companyName: Cigna Group

ticker: CI


text: Cybersecurity represents a critical component of our overall approach to risk management. We generally approach cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when applicable. Additionally, we maintain a cyber insurance policy that covers loss of data and associated recovery, loss of revenue due to business interruptions from a cybersecurity event, loss of transferred funds from events such as fraud and social engineering, and loss of funds from computer fraud and extortion.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see "Significant disruptions of information technology systems or data security breaches could adversely affect our business" under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls and processes; periodic required cybersecurity awareness training of our employees;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: The Company's process for identifying and managing first and third-party risks from cybersecurity threats includes proactive threat hunting, continuous monitoring of the Company's systems and network for cybersecurity events, and regular testing of the Company's Security Incident Response Plan, Business Continuity Plan, and Disaster Recovery Plan. An external managed security services provider and an industry-leading security tool continuously monitors, detects, and responds to the Company's systems and network for cybersecurity threats. The Company's IT security partners evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. A third-party with extensive experience in incident response and forensics is on retainer to assist with incidents. The Incident Response Plan includes reporting and escalation procedures to inform the Company's executives, the Audit Committee, and full Board of Directors, as appropriate, to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Incident Response Plan and Disaster Recovery Plan include procedures for business recovery and are tested at least annually. The Company also maintains a cyber insurance policy that provides coverage for material IT security incidents.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: To operate our business, we also use third-party vendors to perform a variety of functions, including but not limited to, developing aspects of our platform, hosting and delivering our platform and related services, supporting the sale and marketing of our products and services, and providing technical and customer support. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the vendor, our vendor management process may involve different measures designed to help identify, assess, and manage cybersecurity risks associated with the vendor, such as conducting risk assessments and re-assessments, reviewing of the vendor's security program, and imposing contractual cybersecurity-related obligations on the vendor. For example, our security, privacy, and IT teams may review the vendor's security protocols, data retention policies and privacy policies, privacy practices, and security track record, and advise on implementation best practices.

companyName: Asana, Inc.

ticker: ASAN


text: We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had and are not reasonably likely to have a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to our service delivery; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on Company cybersecurity risks.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our current Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: Our management team, including our Chief Financial Officer, along with third party infrastructure providers are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: 4. The IRT, in consultation with outside experts if needed, is responsible for initial containment, analysis, incident containment, incident eradication, and recovery. The IS team also coordinates with our legal and compliance teams as needed; and 5.After each significant incident, analyses are conducted to improve prevention and make incident response processes more efficient and effective.

companyName: Pennant Group, Inc.

ticker: PNTG


text: Operational staff members actively maintain, review, update and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques and their responsibilities to keep our information confidential, accurate and available.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: While everyone at Upwork plays a part in managing cybersecurity and data privacy risks, oversight responsibility is shared by our board of directors, audit committee, and management.

companyName: UPWORK, INC

ticker: UPWK


text: Our Board of Directors considers cybersecurity risk as a critical part of the enterprise and its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Risk Management and Strategy; Governance American Equity maintains a documented Information Security Risk Management Program ("Program") that includes risk assessments regularly conducted by American Equity and third-party experts, assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company's overall risk management system. The Program is informed by industry standards and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies.

companyName: American National Group Inc.

ticker: ANG-PD


text: Risk Assessment – We regularly conduct risk assessments to identify and evaluate potential cybersecurity threats and vulnerabilities. These assessments consider factors such as our current IT infrastructure, the sensitivity of our data, industry best practices, and emerging cybersecurity trends.

companyName: ESCALADE INC

ticker: ESCA


text: Another aspect of our security program is vulnerability management, which includes, among other things, asset discovery and inventory, third-party vulnerability scanners, patch management and remediation, configuration management, as well as penetration testing.

companyName: HERBALIFE LTD.

ticker: HLF


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology (NIST) guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.

companyName: Inogen Inc

ticker: INGN


text: The Company's cybersecurity risk management program includes an incident response plan, which provides a documented framework to support the timely and effective resolution of actual or attempted cybersecurity incidents. Cybersecurity incidents across the Company, and relevant third-party service providers, are tracked and significant incidents, as applicable, are promptly escalated to a cross-functional cybersecurity task force so that decisions regarding public disclosure can be made in a timely manner by management and the Board.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or patients, violation of data privacy or security laws, litigation, and legal, financial and reputational risk.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: The Company also requires cybersecurity training for certain employees, focusing on the appropriate protection and security of confidential company and third-party information. Additionally, the Company provides annual cybersecurity awareness training that covers a broad range of security topics, which may include secure access practice, phishing schemes, remote work and response to suspicious activities. In addition to online training, employees are educated through a number of methods, including event-triggered awareness campaigns, recognition programs, security presentations, company intranet articles, videos, system-generated communications, email publications and various simulation exercises.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have had or are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition.

companyName: STORE CAPITAL LLC


text: As of the date of this report, we do not believe any risks from cybersecurity threats have materially affected Agilent, including our business strategy, results of operations, or financial condition. However, we can provide no assurance that there will not be any incidents in the future or that they will not materially affect us as outlined in Item 1A. Risk Factors.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that has or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K under the heading "Risks Related to Our Information Technology," which should be read in conjunction with the foregoing information.

companyName: Everi Holdings Inc.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: We also engage external cybersecurity consultants and use industry-standard tools to help monitor our networks, review vulnerability scans, and conduct penetration testing on a periodic basis. Our risk management practices are integrated into our overall enterprise risk management framework, as discussed in Item 1A – Risk Factors.

companyName: INTERGROUP CORP

ticker: INTG


text: EIS conducts cybersecurity evaluations, reviews and due diligence of (i) critical vendors periodically and (ii) all new vendors prior to onboarding. Vulnerabilities in third-party providers' information security environments and software are monitored and managed through EIS' vulnerability management program. This program aggregates findings from the vulnerability detection and secure configuration management tools within a dashboard, which allows EIS personnel to focus on high priority matters.

companyName: ROBERT HALF INC.

ticker: RHI


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. We maintain an enterprise risk management program, which includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. Our cybersecurity strategy includes defense in depth and zero trust based controls intended to protect our information technology systems. We maintain an enterprise information and cybersecurity program. As part of this program, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our partner facing policies and statements related to cybersecurity; conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; conducting phishing email simulations for employees and contractors with access to corporate email systems; requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and employing a cyber risk management and quantification system customized to our environment.

companyName: Evolent Health, Inc.

ticker: EVH


text: Management Oversight The CIRT also acts as a cybersecurity risk committee. The CIRT has responsibilities that include receiving and reviewing reports from the CTO and CISO on their management, monitoring and coordination of the Company's cybersecurity and technology risk management and any required remedial or corrective actions, reviewing reports from the CTO and CISO on the effectiveness of the ISP and serving as the primary response and escalation point for cybersecurity matters under the ISP.

companyName: PJT Partners Inc.

ticker: PJT


text: The Information Security team has adopted the NIST Cybersecurity Framework as a reference to manage cybersecurity risks. This framework enables the team to implement a comprehensive statement of activities and responsibilities that cover data, information architecture, risk communications, emerging technology, third-party risk, IT operations, and regulation. By following industry best practices, the team has established a recognized baseline for engaging external firms to audit and test the resiliency of the cybersecurity program.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: The EDA is responsible for managing the Company's cybersecurity risks. The current EDA has over 15 years of experience in IT oversight.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: e. A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and regular tabletop exercises to assess our response readiness; and f. A third-party risk management process for key service providers, suppliers, and vendors who access critical systems and data based on risk profile.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: The Board oversees Sinclair's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's Chief Information Security Officer briefs the Board on the effectiveness of Sinclair's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk management process.

companyName: Sinclair, Inc.

ticker: SBGI


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"). Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: We have a third-party security policy in place to identify, manage and oversee the potential material risks from threats associated with the use of third-party service providers. We evaluate vendors and consider amongst other factors the criticality of services and sensitivity of information that is within the scope of the services to be provided and manage risk accordingly. Our internal legal department reviews all IT Service Agreements with input from the IT department to ensure that services, terms and conditions in the agreement are suitable. Our IT department performs regular monitoring of vendor services as part of its' on-going review and monitoring of vendors. As part of our policy, we monitor termination of agreements with vendors designed to ensure that access to Company information is appropriately terminated in a timely manner. Unauthorized network intrusions or other significant information security incidents against third-party systems used by the Company internally are handled in the same manner as internal systems. However as described in Part 1. Item 1A. Risk Factors of this Annual Report on Form 10-K under "Risks Related to the Operation and Growth of Our Business", we have limited insight into the data privacy or security of third-party service providers and our response may be limited or more difficult because we may not have direct access to their systems.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Like other companies, we are the target of cyberattacks. In 2020, for example, we publicly announced that we were the target of a systems intrusion in which a third party infected certain of the Company's systems with malware. Although we were able to resolve that matter without material impact, we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks or any future material incidents. For more information, see Item 1A. Risk Factors, including the risk factor titled "We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to disruption, failure and cybersecurity breaches of these systems."

companyName: EMCOR Group, Inc.

ticker: EME


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large, publicly-traded organization and has held other vital IT positions over the course of his over 25 year career.

companyName: Westrock Coffee Co

ticker: WEST


text: We have experienced leaders responsible for assessing and managing risks arising from cybersecurity threats. Our CISO reports to the CIO and has served in various roles in information technology and information security for over 28 years, including most recently leading the Information Security Office of BorgWarner Inc. He holds a Bachelor of Science in Physics. The Company's CIO reports to our CEO and has served in various roles in information technology and information security for over 25 years, including most recently as CIO of Gentherm Incorporated. Our CIO holds a Bachelor of Science in Business, with a concentration in Computer Information Systems, and an MBA in Finance and Strategic Management. He is also a Digital Directors Network (DDN) Boardroom Certified Qualified Technology Expert (QTE). In addition, the Company's CEO, CFO and General Counsel each have experience overseeing the management of cybersecurity and other risks similar to those impacting the Company's business.

companyName: PHINIA INC.

ticker: PHIN


text: Cybersecurity Incident Response and Recovery Planning We have established and maintain incident response and data recovery plans that address our response to a cybersecurity incident. Our Cybersecurity Committee and members of the Cyber Security Incident Response Team (which contains additional information technology specialists) regularly test and evaluate the effectiveness of these incident response and data recovery plans. In addition to the incident detection safeguards described above, our cybersecurity policy requires employees and third party vendors to report any and all cybersecurity incidents to our IT department.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: Occidental's CIO, who has over 20 years of IT and cybersecurity experience at the Company and elsewhere, heads the team responsible for implementing and maintaining cybersecurity and data protection practices across Occidental's businesses and reports directly to the President and CEO. Occidental has a centrally coordinated team, led by its CIO, responsible for implementing and maintaining cybersecurity and data protection practices across the Company. Occidental's CIO regularly reviews risk management measures and the overall cyber risk strategy implemented and maintained by the Company. The CIO receives regular updates on Occidental's cybersecurity program and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through reports from the Company's cybersecurity leaders, each of whom is supported by a team of trained cybersecurity professionals. In addition to Occidental's extensive in-house cybersecurity capabilities, Occidental also engages assessors, consultants, auditors or other third parties when necessary to assist with assessing, identifying and managing cybersecurity risks.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Our board of directors is responsible for oversight of our strategy and risk management, including material risks related to cybersecurity threats. The board of directors engages in regular discussions with management regarding our significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.

companyName: CANNAPHARMARX, INC.

ticker: CPMD