text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 25 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, see Item 1A "Risk Factors—Risks Related to Our Business."

companyName: Korro Bio, Inc.

ticker: KRRO

secItem: Item 1C


text: Our Board of Director's role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks. The Board conducts its risk oversight by receiving reports from our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: The integrity and protection of our customer, personnel, financial, research and development, and other confidential data is critical to our business, and our customers and employees have a high expectation that we will adequately protect their personal information. The regulatory environment governing information, security and privacy laws is increasingly demanding and continues to evolve and a number of states have adopted laws and regulations that may affect our privacy and data security practices regarding the use, disclosure and protection of PII. For example, the California Consumer Privacy Act ("the CCPA"), among other things, creates individual privacy rights and imposes increased obligations on companies handling PII.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We examine the effectiveness of our cyber defenses through various means, including internal audits, targeted testing, maturity assessments, incident response exercises and industry benchmarking.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our Board of Directors has an active role in oversight of our risks and is assisted by our management in the exercise of these responsibilities. Our Manager of Information Technology ("IT Manager") prepares and provides a presentation to the Board of Directors at each of its quarterly meetings, which includes updates on cybersecurity. Our IT Manager is responsible for assessing and managing risks from cybersecurity threats and carrying out our formal cybersecurity event plan. Our IT Manager is also responsible for reporting material incidents to our Chief Executive Officer, who in turn will report to the Lead Independent Director. Our IT Manager has over 20 years of IT experience in the energy industry.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Cybersecurity considerations are an integral part of our decision-making processes where communication, data and access are involved. Our Information technology ("IT") department works closely with our operations teams to continuously evaluate and address cybersecurity risks in alignment with our business and operational objectives. Our Chief Information Systems Officer, ("CISO") and IT teams play an important role in assessing the cybersecurity infrastructure employed within our acquired practices to ensure that necessary security enhancements are employed in a timely manner. The Company provides annual cybersecurity awareness training to its employees to mitigate risks by educating employees regarding best practices to avoid cybersecurity related breaches.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: The Senior Vice President of Information Technology and the Director of Information Security bear direct responsibility for daily management of cyber risk. Oversight from the executive team, led by the Chief Administrative Officer, ensures strategic alignment. With a wealth of executive leadership spanning over 20 years in both public and private sectors, these individuals collectively possess more than 75 years of invaluable experience in information technology and security.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: We focus on people because we believe that one of the first lines of defense is our employees. All new employees are required to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. Our employees are required to annually re-affirm adherence to company-wide IT and related policies designed to secure a safe information and communications systems environment. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: As of December 31, 2023, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Our cybersecurity program is designed to address and minimize the risks posed by evolving threats. However, no system can completely eliminate the possibility of a significant cybersecurity incident. Therefore, we continuously assess and enhance our cybersecurity measures to adapt to the changing threat landscape and ensure organizational resilience. For more information regarding the potential impact of cybersecurity risks, please refer to the risk factor entitled "Cybersecurity events or other disruptions of our information technology systems could adversely affect our business" in Item 1A. Risk Factors.

companyName: HEICO CORP

ticker: HEI


text: Together with a third-party, we operate a 24/7 Security Operations Center ("SOC") to monitor the cybersecurity environment and coordinate escalation and remediation of alerts. Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan. This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation. IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required. The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, CAO & Treasurer. The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.

companyName: Murphy USA Inc.

ticker: MUSA


text: We regularly monitor alerts from governmental authorities and industry experts, as well as third party system and organizational controls reports, to remain informed about prevailing and developing cybersecurity threats and bad actor tactics. We also periodically engage third party consultants to conduct independent assessments of our cybersecurity readiness and control effectiveness; to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices; and to inform our cybersecurity strategy. Further, we work with third party experts and leverage external resources to evaluate known vulnerabilities in existing systems and provide remediation steps, as appropriate, and/or otherwise further protect the organization from cyber risk or threats, in each case including cybersecurity threats associated with our use of any third-party service provider.

companyName: HURCO COMPANIES INC

ticker: HURC


text: As of the date of this report, the Company has not experienced any cybersecurity incidents that have had a material impact on its business strategy, financial condition, or results of operations.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Our process for managing cybersecurity risk is comprised of technologies, controls, and procedures designed to detect, assess, and manage threats and control access. We utilize a variety of systems, software, and services including firewalls, network and endpoint monitoring, anti-malware, detection and response, patch management, and backups to mitigate, identify, analyze, and respond to identified vulnerabilities and incidents in a timely manner.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Email Banner for external emails. This banner assists us to identify any phishing / impersonation email and cannot be bypassed.

companyName: Stemtech Corp

ticker: STEK


text: Our information security function is led by our Vice President, Strategy & Finance ("IT Lead"), who reports to our CEO and is supported by our third party security provider, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing report of threats and threat actors and conducting periodic vulnerability assessments for certain systems. Our assessment and management of material risks from cybersecurity threats are considered as part of our risk management processes. For example, our IT Lead and certain management, including our CEO, evaluate identified material risks from cybersecurity threats against our overall business objectives and our IT Lead periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Holley recognizes the importance of maintaining the safety and security of our information systems and data and has risk-based processes in place for overseeing and managing material risks from cybersecurity threats. Our cybersecurity program, which is further described below, is supported by our information technology team, management and our board of directors. Additionally, our cybersecurity processes and reporting structure are incorporated into our enterprise risk management program, which addresses both the corporate information technology environment and customer-facing products. We will continue to invest in the security and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: Holley Inc.

ticker: HLLY


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and Board, as appropriate. The BOTC has primary responsibility for assisting the Morgan Stanley board in its oversight of significant operational risk exposures of the Firm and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures, and cybersecurity risks. Periodically each year, the Audit Committee receives an overview from our Chief Executive Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified, and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Nuburu, Inc.

ticker: BURU


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: Our cybersecurity risk management processes and technical safeguards are supported by consultants and other service providers including for security assessments of our suppliers, independent risk assessments and forensic analyses. We have also retained third-party providers to monitor and assess our cybersecurity posture by a variety of security indicators, cybersecurity threat intelligence signals and other sources and methods. Incident response processes are an integral part of our cybersecurity posture.

companyName: Informatica Inc.

ticker: INFA


text: We continually enhance our security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls through penetration testing, red team testing, consulting on best practices, and to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least twice a year and have access to more frequent cybersecurity training through online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Our CIO, CISO, and Chief Legal & Compliance Officer report quarterly to the ISPC and the Board concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: EVERBRIDGE, INC.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and our vendors have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the section titled "Risk Factors — Risks Related to Information Technology and Data Privacy".

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Incident Response and Readiness Although our Company has not experienced cybersecurity incidents, we maintain a proactive stance through the implementation of an Incident Response Plan. This plan encompasses detailed procedures for addressing potential cybersecurity incidents, including scenario-based drills to test our preparedness. The escalation processes within the plan ensure swift communication to the executive leadership and, if necessary, to the Board of Directors, facilitating an agile and informed response to emerging cybersecurity threats.

companyName: PAID INC

ticker: PAYD


text: Any cybersecurity incidents are immediately reported to the Core Incident Response Team ("Core IRT") which includes key members of management from across the organization. The Core IRT will communicate the incident and potential risks to the Chief Executive Officer. The Core IRT and CEO will determine if the incident should be communicated to the Board of Directors. Any incident that is reported to the Board of Directors includes continuous follow-up as well as detailed documentation provided to the Audit Committee. To date, the Company has not experienced a material cybersecurity incident.

companyName: WideOpenWest, Inc.

ticker: WOW


text: The Bank's policies and procedures concerning cybersecurity matters include processes to safeguard its information systems, monitor these systems, protect the confidentiality and integrity of its data, detect intrusions into its systems, and respond to cybersecurity incidents. Extensive technical controls are in place for identifying and managing cybersecurity risks and safeguarding Bank information systems and information. The Bank uses sophisticated industry-recognized monitoring and threat detection technologies that continuously monitor its information systems and provide threat detection alerts. The Bank's strategy for assessing, identifying, and managing cybersecurity risks and for evaluating the effectiveness of its cybersecurity program includes periodic risk assessments and testing of its systems, processes and procedures through audits, penetration testing, vulnerability scans, tabletop exercises, and other related exercises.

companyName: RBB Bancorp

ticker: RBB


text: We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the EISP. Our cybersecurity program performance and effectiveness are also frequently assessed and audited internally and by third parties.

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: We deploy multiple technical safeguards designed to protect our information systems, including firewalls, intrusion prevention and detection systems, anti-malware tools, access controls, and continuous monitoring. These safeguards are evaluated and enhanced through regular vulnerability assessments, penetration testing and ongoing cybersecurity threat intelligence.

companyName: Pluri Inc.

ticker: PLUR


text: Cybersecurity Governance Matters Our Board understands the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and in maintaining stockholder confidence.

companyName: Integer Holdings Corp

ticker: ITGR


text: The Hines cybersecurity program focuses on the following areas: • Vigilance: Hines' cybersecurity threat operations function around the clock to identify, prevent and mitigate cybersecurity threats and respond to any incidents timely. • Systems Safeguards: Hines deploys systems safeguards that are designed to protect our information systems from cybersecurity threats, including email filtering, website filtering, virus protection, disk drive encryption, multi-factor authentication, mobile device management, and robust network equipment, which are evaluated and improved through ongoing penetration tests and both internal and external audits. • Collaboration: Hines utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. These collaborative efforts include relationships with security operation center service and brand protection providers as well as cloud-based backup service providers. • Third-Party Risk Management: Hines utilizes a risk-based approach to cybersecurity risks presented by third parties, including the systems of third parties that could adversely impact our business. • Training: Hines provides periodic training for personnel regarding cybersecurity threats, such as cybersecurity awareness videos and phishing campaigns. Such training is adjusted to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Communication: Hines has formed an incident response team to address potential cybersecurity incidents. This team is composed of management personnel from Hines' technology, operations, legal, risk management, internal audit and other key business functions and is responsible for informing Hines' leadership, as necessary. The team also includes at least one of our officers to ensure that decisions regarding the disclosure and reporting of such incidents can be made by us in a timely manner, including communicating to our Board, if applicable.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Engaging Third Parties in Risk Management. We use a combination of internal resources and external assessors, consultants and auditors to conduct our cybersecurity risk assessments and identification. We periodically examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines, along with compliance with our internal cybersecurity controls. We also work with third parties to assess our incident response preparedness and to manage and track our risks.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services, and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: Trusted partners are an important part of our cyber risk management program. We partner with leading cybersecurity advisors and service providers to conduct periodic risk assessments and to monitor and maintain the performance and effectiveness of security controls used in our environment.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for oversight of our cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols, while our Facilities Security Officer ("FSO"), and IT Manager are responsible for assessing and managing cybersecurity risk. We use a third-party service which monitors the Company's security threats twenty-four hours each day throughout the year. Any detected deviation from the expected operating parameters will initiate a communication to our IT Manager for investigation and remediation of the detected deviation in a timely manner.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Third-party security firms are used in different capacities to provide or operate some of these programs, controls, and technology systems, including cloud-based platforms and services.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: Disclosure Committee The Disclosure Committee, which consists of individuals from our legal, accounting, finance and investor relations groups, provides general oversight in the area of cybersecurity and privacy, and is responsible for making disclosure determinations regarding cybersecurity incidents. The Disclosure Committee also receives periodic updates from the Chief Information Security Officer regarding threat detection and incident response.

companyName: US Foods Holding Corp.

ticker: USFD


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity events, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."

companyName: Arteris, Inc.

ticker: AIP


text: Management Personnel Our internal cybersecurity control group has responsibility for assessing, monitoring, and managing risks related to cybersecurity threats. The control group is comprised of members of senior leadership, including in-house legal counsel, and multiple independent third-party Certified Information Systems Security Professional (CISSP) Information Technology and Cybersecurity consultants. Specifically, we have retained a Virtual Cheif Information Security Officer and other members of our cybersecurity control group, each of whom supports our cybersecurity risk management and governance practices. Such retained individuals have substantial prior work experience in various roles involving cybersecurity risk management and information technology, including security, compliance, systems and programming, and bring a wealth of expertise in their roles. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy process described above, and report to our internal cybersecurity control group and executive team on a regular basis (at least monthly).

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CDIO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. Accordingly, the Company's Board, through the RMC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight, as described more fully in our Proxy Statement, while management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk.

companyName: EVEREST GROUP, LTD.

ticker: EG


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, encryption and authentication technology and other functions. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.

companyName: Cardlytics, Inc.

ticker: CDLX


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) the security organization is engaged in all major changes to the Company's environment or products to conduct a risk assessment and identify potential cybersecurity risk; (2) cybersecurity risk is a component of the Company's enterprise risk management program and managed within the Company's risk register; (3) the security organization works with senior leadership across the Company to prioritize our risk management processes and mitigate cybersecurity threats that are most likely to lead to a material impact to our business; and (4) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports the results to the board of directors, which evaluates our overall enterprise risk.

companyName: Fastly, Inc.

ticker: FSLY


text: Our cybersecurity program is managed by the Annovis Incident Management Committee (the "AIMC"). The AIMC serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The AIMC is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The AIMC classifies detected cyber incidents to allow prioritization, response and escalation. Incidents (if any) are documented for internal reporting processes and regularly shared with senior management.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 20 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third-party evaluations to our executive leadership team and, as well as regular updates to our Audit Committee. The Audit Committee receives regular updates specific to the company's cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: GENUINE PARTS CO

ticker: GPC


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize an incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.

companyName: LXP Industrial Trust

ticker: LXP


text: Our Information Security Program is integrated into our overall Enterprise Risk Management Program, which covers all company risks. As part of this program appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: GREEN DOT CORP

ticker: GDOT


text: Role of Management One of the key functions of our executive officers is to inform oversight of our risk management process, which includes risks from cybersecurity threats. Our executive officer monitor and assesses strategic risk exposure, and manages the material risks we face.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, and remediation. Our IT team also regularly collects data on cybersecurity threats and risk areas and conducts a periodic risk assessment. Further, we conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The Audit Committee of our Board of Directors has primary oversight over the Cybersecurity program. The Chief Information Security Officer reports at least annually to the Audit Committee and such report may address overall assessment of the Company's compliance with our cybersecurity policies, including risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG Inc.

ticker: TPG


text: Our cybersecurity program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity leadership regularly reports to the board of directors and its risk management committees on information security and cybersecurity matters, including risk assessments, incident responses, and strategic initiatives aimed at mitigating potential threats. For example, the risk management committee in conjunction with management and our enterprise risk management team reviews and discusses cybersecurity metrics on a regular basis that include phishing incidents and training, vulnerability management, and security incident trends.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Based on assessments, management must prioritize risk mitigation efforts, allocating resources effectively. This includes developing strategies to counter or reduce high-priority risks and implementing appropriate security controls.

companyName: DecisionPoint Systems, Inc.


text: We have not experienced any cybersecurity incidents in the last three years, including as a result of the Cyber Incident, that have materially affected the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see "Cyber-attacks or other information security incidents could have a material adverse effect on our business strategy, results of operations or financial condition and subject us to additional legal costs." in Item 1A. Risk Factors.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: The Company continuously enhances policies and procedures, and controls to mitigate against the substantial rise in the prevalence of cybersecurity risks and challenges to protect its data.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 24 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Our business depends on the availability, reliability, and security of our information systems, networks, data and intellectual property. Any disruption, compromise or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships or loss of market share. In the last three years prior to filing of this Form 10-K, we have not experienced any significant information security breach.

companyName: Hub Group, Inc.

ticker: HUBG


text: The CFO is responsible for hiring appropriate personnel (including selecting third-party cybersecurity vendors), helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CFO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and periodically reported to our Audit Committee of the Board of Directors, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct regular tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees, directors and consultants with tools to make employees, directors and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Humacyte, Inc.

ticker: HUMA


text: Technical Safeguards—We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including rate-limiting and web application firewalls, anti-malware functionality, access controls, and threat detection systems including posture management tooling. We ensure the ongoing security and improves these technical safeguards through regular security reviews of components, code, libraries, and environments.

companyName: Redfin Corp


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Director of IT Security, reporting to the CIO. Our Director of IT Security oversees our cybersecurity program, tests our compliance with standards, remediates known risks and leads our employee security training program. With over 25 years of experience in the field of cybersecurity, our Director of IT Security brings a wealth of expertise to the role, including extensive experience as an enterprise head of security and recognition within the industry. Our Director of IT Security provides in-depth knowledge and experience, which is instrumental in developing and executing our cybersecurity strategies.

companyName: ZimVie Inc.


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect CTBI. However, future incidents could have a material impact on CTBI's business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included Management

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: The Company's senior management is actively involved in oversight of the Company's risks and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). In general, the Company seeks to address cybersecurity risks through an approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."

companyName: Southland Holdings, Inc.

ticker: SLND


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures of the Company's or the third parties' on which we rely information systems, data and networks may disrupt our businesses, damage our reputation, expose us to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on our results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The Company has cybersecurity insurance designed to cover certain expenses related to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Our IT policies communicate our expectations of employees and contractors to maintain the security of our IT systems. We perform annual cyber security training to remind our employees about the importance of keeping our systems safe, and perform regular third-party phishing campaigns.

companyName: Green Plains Inc.

ticker: GPRE


text: Our Board of Directors has delegated the responsibility for the oversight of cybersecurity risks to the Information Security and Technology Committees, which are ultimately responsible for assessing and managing our material risks from cybersecurity threats. The Information Security team and the Information Security Committee provide periodic cybersecurity program updates to senior management and to the Board. Management also updates the Board as new risks are identified and the steps taken to mitigate such risks.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature of the event (e.g. ransomware, personal data breach, intellectual property breach, theft or fraud) and assessing the severity of the event and sensitivity of any compromised data according to preset criteria. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.

companyName: American Homes 4 Rent

ticker: AMH


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to help identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.

companyName: Spok Holdings, Inc

ticker: SPOK


text: Our cybersecurity steering committee (the Steering Committee) oversees technical matters regarding cybersecurity through periodic meetings and frequent communications. When formal meetings are held, attending committee members include representatives from the I&T, regulatory affairs, quality, finance, and legal and compliance departments. The Steering Committee has a charter that is reviewed internally to ensure it is aligned with our business strategy. As outlined in its charter, the Steering Committee has three key roles: (i) systems assurance: to oversee the establishment and maintenance of effective cybersecurity mechanisms throughout the Company; (ii) documentation: review of documented policies, standards, processes, and procedures that will have a direct or indirect impact on the security and privacy of our information; and (iii) management of information security risk: identify and manage significant cybersecurity risks across the Company, including escalating to our executive leadership team where appropriate.

companyName: Deciphera Pharmaceuticals, Inc.


text: The annual renewal of our cybersecurity insurance policy includes an internal audit of cybersecurity defense, response, recovery, and remediation protocols. The independent third-party audit is based on criteria designed to meet cybersecurity industry standards.

companyName: Guardion Health Sciences, Inc.


text: cybercrime coverage (including financial fraud, telecommunications fraud, and phishing attacks); and coverage for system failure, bricking loss, and physical damage. The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a Business Combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Newbury Street Acquisition Corp

ticker: NBST


text: Primary responsibility for assessing any cybersecurity risks rests with our management, who would report any threat to our board of directors.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Lord Abbett has instituted an Information/Cybersecurity Program, based on the National Institute of Standards & Technology (NIST) Cybersecurity Framework of controls that is designed to identify, assess, and manage cyber risks applicable to the Company. The Information/Cybersecurity Program involves, inter alia, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. Lord Abbett actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Lord Abbett Private Credit Fund


text: We have implemented a cybersecurity program including processes, technologies, and controls to assess, identify, and manage material risks from cybersecurity threats. This program includes implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. We maintain a formal information security training program for employees that includes training on matters such as phishing and email security best practices. Employees are also required to complete mandatory training on data privacy. We also have a third-party cybersecurity risk review process, including requiring key third-party service providers to complete initial and periodic security assessments, which prioritizes, monitors and assesses the risks associated with our third-party service provider interactions. To evaluate and enhance our cybersecurity program, we periodically utilize third-party experts to undertake maturity assessments of the program.

companyName: ESTEE LAUDER COMPANIES INC

ticker: EL


text: The cybersecurity risk assessment process includes three parts: (1) identification of assets such as information, services, software, and their dependencies, (2) an assessment of the criticality of the assets based on factors of confidentiality, integrity and availability, and (3) an assessment of other criteria to determine the impact a threat can have on each asset and the likelihood that such a threat occurs. Based on the risk assessment process, risk-based analysis, and using an internationally recognized information security framework as a reference, security controls are chosen.

companyName: GUESS INC

ticker: GES


text: The Board oversees the Partnership's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity specialist briefs the CEO, who presents to the Board annually, on the effectiveness of the Partnership's cyber risk management program and any potential cybersecurity threats. Cybersecurity risks are reviewed by the Board, at least annually, as part of Highline's corporate risk mapping exercise.

companyName: GPB Automotive Portfolio, LP


text: The above cybersecurity risk management processes are integrated into our overall risk management program. Cybersecurity threats are understood to be wide reaching and to intersect with various other enterprise risks. In addition to assessing our own cybersecurity preparedness, we also consider cybersecurity risks associated with our use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers.

companyName: Fat Brands, Inc

ticker: FATAQ


text: Cybersecurity is an important part of our risk management processes and an area of continued focus for our board and management. The audit committee of the board of directors is responsible for the oversight of the company's enterprise risk management program, including reviewing and discussing with management at least annually (i) management's report on risk management, including management's assessment of risk exposure (for example, risks relating to operations, climate change, cybersecurity threats and regulatory compliance, among others), the processes in place to identify and manage significant risks, and steps taken by management to control or mitigate such exposures, and (ii) management's report on cybersecurity risk management, which may include a review of the company's cybersecurity framework, priorities, risk profile, and processes, controls and strategy to mitigate data protection and cybersecurity risks. Pursuant to the company's incident response plan, management would discuss with the audit committee any significant cybersecurity incidents that may have a material effect on the company's business or its financial statements and management's mitigation and remediation plan for such incidents.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: The Audit Committee of the Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align the Company's risk exposure with its strategic objectives. The CIO provides periodic updates to the Audit Committee on the status of the Company's cybersecurity risk management program; the Company's information systems, cybersecurity, data privacy and other risks; and the steps management has taken to identify, monitor and mitigate such risks. The Audit Committee is also briefed on cyber crisis contingency planning, incident recovery capabilities and matters related to any material cybersecurity incident the company may experience.

companyName: OSHKOSH CORP

ticker: OSK


text: Additionally, Carpenter Technology leverages third party security firms in various capacities to assist with various aspects of Carpenter Technology's cybersecurity program, including risk assessments, vulnerability scans and penetration testing. Carpenter Technology uses a variety of processes to address cybersecurity threats related to the use of third party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of Carpenter Technology's process to continuously improve its cyber and information security programs, Carpenter Technology also engages third party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: The Audit and Risk Committee ("ARCom") of the board of directors of the General Partner's parent entity, (the "Board") is responsible for risk governance and management frameworks, determining risk strategy and ensuring that risk is monitored and controlled effectively. The risk management framework requires that the Partnership operates within acceptable risk tolerances, while risk governance provides a foundation for potential oversight in an evolving cyber environment. The ARCom meets quarterly to discuss cybersecurity risks and events and reports its findings to the Board. The chief information security officer presents to the ARCom quarterly, including providing incident reports for potentially material security incidents, and all Board members have the opportunity to ask questions. The full Board also discusses cybersecurity risks and events quarterly.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners and employees.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: While everyone at Peloton has a role in managing cybersecurity risks, our Board of Directors and senior management team are actively involved in the oversight of our cybersecurity program. Our Board of Directors and the Audit Committee of our Board of Directors oversee Peloton's cybersecurity matters through regular reports and reviews, as well as reporting on material cybersecurity incidents. These include presentations by the Company's Senior Vice President, Chief Security and Trust Officer ("CISO") to the Audit Committee on a quarterly basis, along with ad hoc reports on cybersecurity incidents, threat detection and mitigation plans to the Audit Committee, our Board of Directors and our executive team.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: In the event that a cybersecurity incident is detected, the IRT performs a multi-factor, risk-based assessment to determine the appropriate level of response. Depending upon the results of the assessment, including the nature and magnitude of the event, our incident response procedures provide for oversight and management of an incident by the IRT, under the direction of the CIO, or, in the event of escalation, under the direction of the executive officers of the Company, with reporting to and oversight by the Audit Committee.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: The Company subscribes to a defense in depth strategy when it comes to cybersecurity and has processes in place to assist in the assessment, identification, and management of material risks from threats. The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. Semi-annually, the Company performs a risk mitigation assessment to assess and determine specific cybersecurity risks prevalent within the global information technology infrastructure and how those risks are mitigated. Further, through the use of an independent third-party service provider, the Company performs external penetration testing as well as internal network vulnerability testing to assess and identify gaps and vulnerabilities within the global information systems.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: Reporting Cybersecurity Information In terms of reporting, the structure of our cybersecurity information flow is designed to ensure that significant risks and incidents are communicated efficiently to senior management and the board of directors:

companyName: Monogram Technologies Inc.

ticker: MGRM


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts—The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management—The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: In the fiscal year ended January 31, 2024, Zuora also hired a new CISO principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management. Our CISO has served in various roles in cybersecurity and information technology for over 25 years and has experience building security programs and leading global teams at large enterprises and fast-growing technology companies.

companyName: ZUORA INC


text: At least quarterly, the Audit Committee receives a presentation from management members of our cybersecurity committee concerning our cybersecurity threat risk management and strategy processes, which is designed to cover such topics as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks and/or incidents, as well as the steps management has taken to respond to such risks and/or incidents.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: We believe that one of the first lines of defense against cybersecurity threats is our employees. Accordingly, we require all new employees to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. We also require our employees to annually re-affirm adherence to company-wide IT and related policies designed to protect our information and communications systems. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Cybersecurity Risk In recent years there has been an increased risk of information and security risks due to increased sophistication and activities of perpetrators of cyber attacks. The computers are used for our everyday business operations including mobile devices and other online means of activities to connect with our customers, employees, suppliers and other parties. This extensive use give rise to cybersecurity risks such as system disruption, theft and the release of confidential information. There are numerous sensitive information stored in the system and intellectual property, including employees, customers and other financial information.

companyName: Target Group Inc.

ticker: CBDY


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: The Board of Directors is responsible for overseeing our enterprise risk management program. The Audit Committee of the Board of Directors has been designated by the Board to oversee cybersecurity risks and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee receives updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer.

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.

companyName: PROS Holdings, Inc.


text: As part of our cybersecurity program, the Company's VCISO, Senior Vice President of Operations and Vice President of Information Technology, collectively referred to as our "Cybersecurity Team," reviews our cybersecurity posture, identifies areas in need of improvement, and helps foster a culture of compliance (including training of all employees). Our Vice President of Information Technology has over 20 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity program. The Company's program also includes activities to respond to and recover from cybersecurity incidents, including processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: Our approach to managing cybersecurity risk involves a comprehensive program established at each subsidiary and our corporate headquarters. This strategy intends to pinpoint entity-specific risks associated with both our digital and physical assets with the objective of employing effective measures that ensure the security of our infrastructure, systems, data, business partners, customers, and financial information against potential cyber incidents. Corporate management of the holding company oversees the cybersecurity risk program at each of the subsidiaries to ensure the collective cohesively responds to organization-wide risks.

companyName: ARGAN INC

ticker: AGX


text: The Company engages external third parties to perform assessments on our adherence to the FFIEC's recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company's overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security.

companyName: REFLECT SCIENTIFIC, INC.

ticker: RSCF


text: Our cybersecurity risk management processes are a key element of our Enterprise Risk Management ("ERM") process, which is designed to identify and evaluate the full range of significant risks to our business and operations. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning and includes risks identified by our Cybersecurity Governance Committee and information technology and cybersecurity functions as part of the overall review of significant enterprise risks. The top ERM risks are compiled annually and shared with the audit committee of the board of directors as well as the full board of directors. In addition, internal audit incorporates these risks into its continuous risk assessment process. Where appropriate, we seek to include in contractual arrangements with certain of our third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit, and test such vendors' cybersecurity programs and practices. We also utilize a number of digital controls to monitor and manage third-party access to internal systems and data.

companyName: Invitation Homes Inc.

ticker: INVH


text: Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: VAPOTHERM INC


text: Our cybersecurity team is primarily responsible for identifying, evaluating and responding to risks from cybersecurity threats. Our cybersecurity team is led by our Senior Vice President, Information Technology, who has an undergraduate degree in electronic and communications engineering and over 20 years of experience in information technology, including cybersecurity risk management. Our cybersecurity team reviews and assesses our cybersecurity profile against internal and external cybersecurity frameworks that are aligned with industry standards on an ongoing basis and conducts ongoing security management internally and through the engagement of third-party vendors and consultants. In addition, our cybersecurity team periodically engages independent third parties to conduct security assessments and internal and external penetration tests. Our cybersecurity team seeks to detect potential cybersecurity incidents through technical safeguards such as automatic detection systems, as well as through our policies and procedures that require internal and external notification of cybersecurity incidents. When a cybersecurity incident occurs, our cybersecurity team implements our incident management procedures and convenes an incident response team consisting of members of our IT team and other company representatives as appropriate based on the nature of the incident. The incident response team determines appropriate containment, eradication and recovery procedures based on the type of incident and recommends any corrective actions to the cybersecurity team following the resolution of the cybersecurity incident. Cybersecurity incidents are reported to our Board of Directors, our Audit Committee or its Information Security Subcommittee as appropriate based on the nature of the incident.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: We continually monitor and evaluate the evolving cybersecurity landscape and the potential impact of cybersecurity incidents on our business. We may incur additional costs to enhance our cybersecurity processes and controls, to comply with new or changing laws, regulations, or contractual obligations, or to respond to or recover from cybersecurity incidents. We may also experience reputational harm or loss of customer confidence or trust as a result of cybersecurity incidents. Any of these factors could have a material adverse effect on our business, financial condition, results of operations, and reputation.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our current cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: Clean Harbors recognizes the critical importance of developing, implementing and maintaining cybersecurity measures to safeguard our information technology. The Company has integrated cybersecurity risk management into our overall risk management framework to collectively assess and respond to operational, financial and cybersecurity risks.

companyName: CLEAN HARBORS INC

ticker: CLH


text: We regularly engage independent third-party security consultants to help assess and monitor our IT and OT environments for vulnerabilities, to conduct penetration testing and to recommend mitigation strategies. In addition, we use third-party tools for vulnerability scans to identify external and internal risks. Our cybersecurity program includes a process for overseeing and identifying cybersecurity risks associated with our third-party service providers.

companyName: HF Sinclair Corp

ticker: DINO


text: In addition, iRobot's internal audit team facilitates risk assessment activities and manages formal IT general controls, evidence collection, and attestation for SOX compliance. We also engage with a range of external experts, including cybersecurity assessors and consultants to support the evaluation and testing of our risk management systems. These third parties assist with the preparation of threat assessments and penetration tests, and consult on security enhancements.

companyName: IROBOT CORP

ticker: IRBTQ


text: The Program is led by our CISO, who reports directly to the Senior Risk Officer. Additionally, the CISO meets regularly and works in tandem with the Chief Information Officer and various members of Information Technology. The Information Security Department meets regularly with employees through hosted educational sessions, all-employee call presentations, Officers' meeting presentations and individual Branch network visits. Line of business leaders regularly reach out to the CISO with regards to cybersecurity risk prevention, questions, and training. The CISO has a standing agenda item for the Information Technology Steering Committee meeting as well as ERC in order to inform the committees about prevention, detection, mitigation and remediation of cybersecurity incidents. If there are any incidents that require information to be presented to the Executive Management Team or the Board, the Senior Risk Officer presents that information. The CISO reports to ERC on a quarterly basis regarding the cybersecurity program and material cybersecurity risks.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: In addition to internal measures, we manage cybersecurity risks associated with third-party suppliers, particularly those with access to our systems or confidential data. We perform due diligence on critical third-party suppliers and monitor identified cybersecurity threats.

companyName: Outdoor Holding Co

ticker: POWW


text: The CISO and CIO meet regularly with the chair of the Technology Committee outside of committee meetings. In addition, the board of directors regularly receives information about these topics from the chair of the Technology Committee, the CIO, and management, and the board of directors is apprised directly of incidents as appropriate, pursuant to our incident response plan.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: In the last three years we have not experienced any cybersecurity incident that has been material to the results of our operations or that has caused us to incur any material expenses.

companyName: DANA Inc

ticker: DAN


text: In conjunction with the aforementioned plans, the Company conducts an annual business impact analysis to identify the critical business functions that are required by the Company to sustain business operations and potential impacts to the Company if any those critical functions are disrupted. Deriving from the analysis, the Company maintains a business continuity and disaster recovery plan to coordinate business recovery to resume any disrupted critical business operations. In the event of a critical cybersecurity business disruption, the President of the Company may activate the business continuity plan to implement risk-based strategies devised to maintain business continuity against distributed denial of service attacks or malware.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Management is responsible for assessing and managing risks from cybersecurity threats and implementing the Company's cybersecurity strategies. Our CTO focuses on current and emerging cybersecurity matters and is responsible for establishing and maintaining the Company's cybersecurity-related policies and procedures. Our CTO has an Engineering degree from Rice University, a Master of Business Administration from Harvard Business School, more than 20 years' work experience, and a background in leading digital / software development organizations. Supporting our CTO is the Company's Vice President of Corporate Platform and Infrastructure and our team of cybersecurity experts (collectively with the CTO, the "Technology Team"). Our Vice President has an undergraduate degree from The University of Houston and has served in various Information Technology and Information Security roles for over 20 years across oil and gas, consulting, and power generation sectors. This team is collectively responsible for upward reporting on an as-needed basis of emerging cybersecurity incidents to senior management and, if appropriate, the Audit Committee of the Board of Directors. To facilitate effective oversight, our Technology Team holds regular discussions with our management team, the Audit Committee and the Board of Directors around cybersecurity risks, incident trends, and the effectiveness of our cybersecurity measures.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: Our information security program includes the following key elements to help identify, manage, mitigate, and respond to cybersecurity threats: • Risk assessments—We conduct risk assessments designed to help identify material cybersecurity risks, quantify the impact and probability of each risk, develop mitigating controls, and periodically reassess previously identified risks. • Testing—We conduct regular testing of our systems and controls to help identify and address potential vulnerabilities. • Technical safeguards—We utilize various technical safeguards to help protect our information systems from cybersecurity threats. We regularly review our technical safeguards and update them in accordance with recognized best practices and standards. • Business continuity and disaster recovery planning—We maintain business continuity and disaster recovery plans and periodically test those plans. • A cybersecurity incident response plan—We maintain a policy governing actions required for reporting and managing cybersecurity incidents. We have designated an Incident Response Team with clearly defined roles and responsibilities for managing all material aspects of our reporting and response plan. • Employee training and awareness programs—We provide training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate in annual training, including insider threat awareness, simulated phishing exercises, and other awareness training. • Third-party risk management—We maintain a third-party risk management program that is designed to help identify, assess, manage, mitigate, and respond to risks associated with the Company's suppliers and other third parties.

companyName: Red Violet, Inc.

ticker: RDVT


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity awareness. 26North also performs tabletop exercises and disaster recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.

companyName: 26North BDC, Inc.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a commercial space company, we must comply with extensive regulations, including requirements imposed by the Department of Defense related to contracts with government agencies and reporting cybersecurity incidents to the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to our IT Incident Response Coordinator who will investigate the direct impact of the incident. Once a potential incident has been confirmed, the Incident Response Coordinator will notify senior management that activation of the incident response plan is required and assign a severity rating, ranging from none to critical, based on the perceived impact.

companyName: Sidus Space Inc.

ticker: SIDU


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results."

companyName: REDWOOD TRUST INC

ticker: RWT


text: Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. With that objective, the Company undertook a focused cybersecurity assessment conducted by an independent cybersecurity advisory firm to better understand the current cybersecurity threats and risks necessary to establish the foundation of a cybersecurity risk assessment framework appropriate for its current business operations and needs. The Company has also engaged well-known and established technology suppliers to support its key technology processes and operating technical security management activities including threat, vulnerability, and network security management.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: The Core Team members are augmented as needed by representatives from other internal groups, including subject matter experts from Information Security, Privacy, Finance and Law, as well as certain third parties that may need to participate in the incident response process. Depending on the severity and impact of the incident, third parties engaged may include outside counsel, forensics investigators, public relation firms, data breach resolution providers, and cyber insurance brokers and carriers. In conjunction with legal counsel, the Core Team evaluates notification requirements and as necessary will notify stakeholders depending on the nature and severity of the incident, including law enforcement, state attorneys general, regulators, external auditors, third party providers, and impacted individuals.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: Board of Directors -- The audit committee of the Company's board of directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee and the board of directors are informed of material risks from cybersecurity threats by the Company's Chief Executive Officer, Chief Financial Officer, or the Senior Vice President of Information Technology.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: The Board and the Enterprise Risk Management Committee have oversight responsibility for our information security program and receive regular updates on the status of the program and any emerging threats or incidents with the potential to impact operations or financial performance. To ensure that the Board is fully informed about cybersecurity risks, the ISO provides regular reports to both the Board and the Enterprise Risk Management Committee. These regular reports include an overview of the Company's current cybersecurity risk assessment, key risk areas, and any significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Enterprise Risk Management Committee receives regular updates on cybersecurity trends and emerging threats from program management. Our Audit Committee also plays a role in overseeing the Company's cybersecurity and information security program. The Audit Committee reviews final reports from third party engagements and receives presentations at its meetings concerning cybersecurity risk and related issues. All members of the Board receive copies of Audit Committee reports.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: We partner with experienced external consultants to assess our cybersecurity program, and to perform penetration testing as well as other testing programs designed to identify vulnerabilities and areas for fortification. Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us against all types of claims related to security breaches, cyberattacks and other related breaches.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies and governance processes across the risk management program. Key elements of our cybersecurity risk management program, include but are not limited, to the followings: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security processes; • cybersecurity awareness training for our employees, including incident response personnel and senior management, on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors; and • cybersecurity internal and external penetration testing.

companyName: NOVANTA INC

ticker: NOVT