text: The Company uses ERM principles to help identify, prevent, and mitigate potential risks, including cybersecurity and related risks. We base our ERM program on the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework. Individuals representing Stepan's global locations and functions contribute to our risk assessments at least annually through surveys and in-person interviews. Members are polled quarterly to spot emerging risks and trends. The Company's Vice President, Chief Compliance and Risk Officer leads the ERM program and reports regularly to the Audit Committee of the Board of Directors on ERM matters.

companyName: STEPAN CO

ticker: SCL


text: Management Oversight While the Audit Committee reviews and oversees the Company's information security efforts, senior leadership is responsible for the day-to-day management of cybersecurity risk and the design and implementation of policies, processes and procedures to identify and mitigate this risk. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Legal department and our Internal Audit department, working with our GTS department. Members of this team include a Certified Information Systems Auditor (CISA), a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Systems Security Professionals (CISSP), as well as members of ISACA and ISC2 industry organizations. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: GLAUKOS Corp

ticker: GKOS

secItem: Item 1C


text: In the event risks are identified and actions are recommended by our consultant, our consultant will interface with our CEO in addressing any identified cybersecurity threats.

companyName: Norris Industries, Inc.

ticker: NRIS


text: installation of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.

companyName: Nano Nuclear Energy Inc.

ticker: NNE


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management and overseeing our data privacy, information technology and security and cybersecurity risk exposures, including: (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (ii) the programs and steps implemented by management to monitor and mitigate any exposures; (iii) our information governance and cybersecurity policies and programs and (iv) major legislative and regulatory developments that could materially impact our data privacy and cybersecurity risk exposure. On a quarterly basis, our General Counsel, Chief Financial Officer ("CFO") and CIO report to the Audit Committee on information technology and cybersecurity matters, including, as appropriate, key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on our business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures and any major legal developments that could significantly impact our cybersecurity risk exposure.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: We have identified certain third parties that pose a higher cybersecurity risk to us because they have significant access to our systems or data. For these higher-risk third parties, we have implemented additional requirements, including: • We assess these higher-risk third parties' cybersecurity controls through a cybersecurity questionnaire and a review of their cybersecurity controls, either through independent audits or by direct review of their cybersecurity policies and practices. • We use third-party cybersecurity monitoring and alert services to monitor these higher-risk third parties. • We conduct periodic monitoring reviews of these higher-risk third parties' cybersecurity policies and practices.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Company's information systems and cyber security policy defines standards, specifies controls, and establishes management responsibilities with respect to identity and access management, authentication requirements, system and device hardening, network security, virus and malware protection, threat intelligence, security event logging and monitoring, endpoint protection, incident response, third-party information security, cybersecurity awareness and training, data backup and restoration, and program governance. In addition, the Company maintains complementary policies that similarly address standards, controls, and responsibilities pertaining to data classification and protection, acceptable use of information technology assets, vulnerability and patch management, business continuity and resilience, information technology lifecycle and asset management, change management, project management, and quality assurance.

companyName: LAKELAND BANCORP INC


text: We have engaged an independent third-party operations center that is focused on, among other things, monitoring alerts, logs, behavior analytics and end devices usage. This continuous monitoring is in conjunction with periodic security assessments, constant vulnerability scanning and frequent penetration tests. We also complete an initial vendor cybersecurity review process for new cloud-based software which provides a standardized review assessment. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors allowing us to increase security of our technology assets and our data.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and periodic cyber security training.

companyName: LXP Industrial Trust

ticker: LXP


text: As part of the Company's information security program, the Company maintains written policies and procedures, such as the Information Security Policy and Company's Incident Response Plan, which identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company's Information Security Policy identifies security controls, appropriate use, and user responsibilities for the organization that are in place to identify and manage the risk of a cybersecurity incident.

companyName: Uniti Group LLC


text: Our IT team, including our Director of IT, is responsible for assessing and managing our material risks from cybersecurity threats. The IT team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our IT team have over 10+ years of experience in operations technology support across multiple industries. The team holds industry standard certifications, related to System, Security and Network Administration, and are required to complete security awareness training multiple times per year.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Seer, Inc.

ticker: SEER


text: We regularly evaluate the cybersecurity risks associated with third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third-party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we week to make third-party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: The Internal Audit function assesses cyber security risks and audits components of cyber security on an annual basis. At least every three years, the Company uses an external party to evaluate the maturity of the program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our cybersecurity risk management program categorizes cybersecurity risks into five areas: identify, protect, detect, respond, and recover. We regularly assess the cybersecurity threat landscape, employing a layered cybersecurity strategy that emphasizes prevention, detection, and mitigation through a variety of technical and operational measures. As a part of our cybersecurity risk management program, our information security program is tailored to address identified risks, while aligning with pertinent business requirements.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: We rely on sophisticated information technology systems and network infrastructure to operate and manage our business. We also maintain personally identifiable information ("PII") about our employees, and given the nature of our business, we have access to protected health information ("PHI").

companyName: Beyond Air, Inc.

ticker: XAIR


text: Prevention and Preparation The Company employs a variety of measures to prevent threats related to privacy, information technology and security and cybersecurity, which include password protection, frequent mandatory password change events, multi-factor authentication, internal phishing testing, and vulnerability scanning and penetration testing. The Company utilizes industry leading solutions for endpoint detection and response, patch management, email security, network security, and privileged access management to provide a layered approach to data security.

companyName: Playa Hotels & Resorts N.V.


text: Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Equillium, Inc.

ticker: EQ


text: Management and Strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Biofrontera Inc.

ticker: BFRI


text: The Company's current Head of Information Security has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.

companyName: IMAX CORP

ticker: IMAX


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Leslie's, Inc.

ticker: LESL


text: At Eos, we leverage a cybersecurity model that focuses on four key areas: prevention, detection, assessment, and remediation through an array of internal and external systems, along with the expertise of third-party service providers. This model is supported internally by Eos' Information Technology Department ("ITD"), along with expertise of external cybersecurity experts. Our model is also supported through security awareness training for all employees during the onboarding process and on a regular basis thereafter.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: The Company is subject to various cybersecurity risks that could impact our systems and our ability to operate. We have developed processes to assess, identify and manage our risks related to cybersecurity threats which are incorporated into the Company's overall risk management process. On an ongoing basis we utilize threat prevention systems to monitor, block and protect our information technology systems which are monitored continuously by trained security personnel. Our process to prevent cybersecurity incidents involves layered security architecture designed to protect our networks, end-user devices, servers, and cloud solutions. On a regular basis, we conduct phishing email simulations and provide training resources to our employees. We have an Incident Response Plan to outline our process to manage cybersecurity threats and incidents. We utilize industry recognized security and compliance experts for regular security assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we review their compliance against internationally recognized standards. However, this does not mean that the Company, or our third-party service providers, will meet, or maintain, any particular technical standard, specification, or requirement in the future, but rather we use these standards as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: key components of our future cybersecurity program will include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;

companyName: Idaho Copper Corp

ticker: COPR


text: We have also instituted a separate process for communicating with the Audit Committee regarding any risks from an actual cybersecurity threat in the event we are the target of a specific cybersecurity incident. As part of our response to such an incident, members of the Incident Response Team would provide an initial awareness communication of the incident to our Chief Executive Officer who would in turn inform the Chairman of our Board of Directors ("Board Chair") and the Chair of the Audit Committee ("Audit Committee Chair"). Following an initial assessment of the incident by senior management and IT Systems personnel, we would provide a follow-up communication to the Board Chair and Audit Committee Chair and determine whether further escalation to the full Board of Directors is warranted.

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: We have incorporated cybersecurity risk into our extensive risk management framework by aligning it with our overall risk strategy. This involves identifying potential cybersecurity threats, assessing their impact and developing mitigation strategies. These governance processes apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, ensuring that cybersecurity risks are managed effectively and are in line with the organization's risk tolerance and business objectives.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate systems), and test that awareness using knowledge assessments and simulations. The training is administered to employees on an annual basis, and we use a third-party provider for the content to ensure that the training is periodically updated to incorporate new cybersecurity-related developments and best practices.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We regularly train all employees on cybersecurity risks, such as phishing attacks, and employees are required to acknowledge our cybersecurity policy annually through our Code of Conduct.

companyName: GoPro, Inc.

ticker: GPRO


text: We describe how risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading, "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated herein by reference. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Cyber Risk Management and Strategy Cybersecurity risk management policies and processes are integrated into EastGroup's enterprise risk management program. These policies and processes include incident response, identity and access management, employee training on cybersecurity matters, device management, patch management and vulnerability assessment. The Company also maintains processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls ("SOC") reports provided by potential vendors. Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company's cybersecurity risks. The cyber consulting firms currently conduct testing of EastGroup's controls and environment, including network penetration testing, to identify and remediate cybersecurity risks. They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including training for all employees. This training supports information security awareness and adherence to Company policies and guidance through regular, mandatory training and random simulated phishing tests.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes. Our CISO has over 30 years of technology experience, including over twelve years of experience dedicated to cybersecurity. He has been in this role with Wesco since 2020 and has a total of approximately nine years of experience serving in the role of Chief Information Security Officer. The CISO reports to our Executive Vice President, Chief Information and Digital Officer ("CIDO"), who reports directly to our Chief Executive Officer. The CISO and CIDO regularly review cybersecurity matters with our Chief Executive Officer and other members of our senior management, including cybersecurity risks and threats and the status of our cybersecurity incident response plan and related processes relating to the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Cybersecurity Incident Response Plan We have a Cybersecurity Incident Response Plan which is maintained by the Security and Compliance Team. The Incident Response Plan establishes what people and organizations need to be engaged in the event of a significant incident. The Incident Response Plan also provides templates for technical resolution, documentation and communication to internal stakeholders as well as insurers and governmental and other regulatory agencies.

companyName: Zumiez Inc

ticker: ZUMZ


text: As part of the above processes, we regularly engage external advisors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards. Our external advisors also act as an extension of our teams to support on daily related security activities, by working closely with our Chief Information Officer and the leader of IT Operations.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: We rely on a multidisciplinary team, including our information security functions, legal departments, management, and third-party consultants, as described further below, at the corporate level and at Tripadvisor to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools, such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Board of Directors Our board of directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company strives to have controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable. • Technical Safeguards: The Company strives to implement and maintain technical safeguards designed to protect the Company's information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls. Such safeguards are generally evaluated through internal security testing, third party penetration testing and vulnerability assessments, as well as outside audits and certifications, and revised as warranted. The Company seeks to comply with the cybersecurity framework guidelines issued by the NIST and ISO. • Education and Awareness: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery in an effort to equip Company employees with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. • Incident Response and Recovery Planning: The Company's Security Operations Center ("SOC"), reporting to the CISO, strives to provide 24x7 incident monitoring. If an incident occurs which SOC determines qualifies as a "critical risk" according to predetermined criteria, Company policy requires the SOC to engage an incident management team to assist with evaluating, responding to and managing the response of the incident. The Company has established and seeks to maintain comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents. The Company strives to conduct periodic drills and tabletop exercises to test these. • Third-Party Risk Management: The Company strives to conduct initial and periodic risk evaluations of vendors meeting predefined criteria for heightened cybersecurity risk, based on their access to or provision of critical information systems or data.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: For the year ended December 31, 2023, the Company had no cybersecurity incidents or was at risk from cybersecurity threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Desert Hawk Gold Corp.


text: We have developed and implemented various processes to oversee and manage the cybersecurity risks that may impact our business and have integrated this cybersecurity risk management framework into our Company's broader risk management framework.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: c. Maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and d. Ensuring business continuity and disaster recovery.

companyName: S&T BANCORP INC

ticker: STBA


text: Our Cyber Security Operations Control center integrates feeds from all key areas of our infrastructure (email, network, endpoint, identity, firewall) into a centralized security information event management, or SIEM, system. This system is integrated with our Incident Response Plan, or IRP, which provides a process for responding to different types of cybersecurity incidents and designates responsibilities and actions to be taken in responding to such incidents. The IRP aims to eradicate problems as quickly as possible, while gathering actionable intelligence, restoring business functions, improving detection, and preventing reoccurrence. It includes guidelines for determining incident type, severity, roles and responsibilities, and escalation points.

companyName: MAXLINEAR, INC

ticker: MXL


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects supporting Seaboard's information security systems, assessments of Seaboard's information security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan improvement expenditures.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.

companyName: Expion360 Inc.

ticker: XPON


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director of Information Technology and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: Nutex Health Inc.

ticker: NUTX


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and other cybersecurity professionals who assist in the identification, verification, and validation of cybersecurity risks, as well as support associated mitigation or incident response plans when necessary.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached or fail and a customer's or our data is improperly obtained or unauthorized access to our information technology systems occurs, we may incur significant legal and financial exposure and liabilities." under the heading Part I, Item 1A "Risk Factors".

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: We have established a continuous monitoring strategy and program, which includes: • a set of defined security metrics to be monitored; • performance of security control assessments on an ongoing basis; • addressing results of analysis and reporting security status to the executive team; • monitoring information systems to detect attacks and indicators of potential attacks; • identification of unauthorized use of the information system resources; and • deployment of monitoring devices strategically within the information system environme nt.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: We recognize the critical importance of maintaining the trust and confidence of customers, clients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks such as the National Institute of Standards and Technology ("NIST") and other similar industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NETLIST INC

ticker: NLST


text: Our executive team, primarily consisting of our Chief Accounting Officer, Chief Financial Officer, and Chief Executive Officer, in conjunction with our information security team and third-party consultants, is primarily responsible in assessing and managing our material risks from cybersecurity threats. The qualifications of our executive and information security teams include a combination of formal education, current trainings and certifications in systems, network, and cybersecurity and over 50 years of combined experience in information technology and cybersecurity matters.

companyName: Innoviva, Inc.

ticker: INVA


text: The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. The Audit Committee and management have engaged a third-party firm to oversee the complete audit of our cybersecurity and risk management systems to ensure the integrity of the systems that are in place.

companyName: OLENOX INDUSTRIES INC.

ticker: OLOX


text: Cybersecurity risks are critical to our business and our process for identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. We rely on complex information technology systems and networks to conduct business, including communicating with employees and our distribution centers, ordering and managing materials from suppliers, selling and shipping products and analyzing and reporting results of operations, as well as for storing sensitive, personal and other confidential information. While we employ resources to monitor and protect our technology infrastructure and sensitive information, these security measures or those of our third-party vendors may not prevent all attempted data security breaches or cyber-attacks. If our or our third-party vendors' information technology systems are damaged or cease to be available or function properly for an extended period of time, whether as a result of a significant cyber incident or otherwise, our ability to communicate internally as well as with our customers could be significantly impaired, which may adversely impact our business. Our acquisition strategy may also result in exposure to certain technology risks during integration of systems of acquired companies to our existing platform.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Our and John Deere's cybersecurity program is designed to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents with the goal of protecting the confidentiality, integrity, and availability of our critical systems and information. We use a risk-based, multi-layered information security strategy to assess, identify, and manage risks from cybersecurity threats. The Cybersecurity Team meets frequently to monitor, assess, and address cybersecurity threats and incidents. We and John Deere also work with third parties to assess the maturity of our cybersecurity program, leveraging the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: DEERE JOHN CAPITAL CORP


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A. Risk Factors."

companyName: SOUTH 8 ENERGY, LLC


text: The controls and processes employed to assess, identify, and manage material risks from cybersecurity threats are implemented and overseen by our Chief Information Officer ("CIO"). Our CIO has more than 20 years of information technology experience, including seven years specializing in cybersecurity. Our CIO is responsible for assessing the impact of cybersecurity threats and incidents, assessing whether and to what extent they can be contained and mitigated, containing and mitigating them, remediating incidents, and performing post-incident analysis and program enhancements. In the event of a significant cybersecurity incident, our CIO would engage senior management to inform them of the incident and related threats and response. We would also likely engage a third-party incident response vendor to assist us in the event of a significant cybersecurity incident. Our Chief Executive Officer directly oversees our CIO and regularly receives information on cybersecurity risks from our CIO as they arise. Our CIO, in turn, is informed about risks from cybersecurity threats through dashboards, email alerts, reporting from the MSSP, and regular review of our systems and information technology environment.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP, on our behalf, to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: Annual cloud system assessments designed to help identify material cybersecurity risks to our critical systems, information and our broader enterprise Information Technology (IT) environment.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Sculptor's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Sculptor prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Adviser or Sculptor. Sculptor's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Adviser or Sculptor, is integrated into Sculptor's risk management program. In addition, Sculptor periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: We identify and address cybersecurity risks associated with key third-party service providers through security and privacy assessments prior to engaging these third parties, the breadth of which is determined by factors such as the type of data, if any, the third party will have access to, whether the third party will have access to our networks and systems, and whether the third party will provide hardware or software to be used in our products or elsewhere in our organization. Depending on the results of these assessments, we may conduct further assessments prior to or periodically throughout the course of our engagement, limit or cease plans to engage the third party, or negotiate specific contractual protections or remediation provisions.

companyName: QuidelOrtho Corp

ticker: QDEL


text: Our Chief Operations Officer and Information Security Officer, along with their departments, are accountable for managing our enterprise information security and delivering our information security program. Their responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. Certain individuals within their departments are generally subject to professional education and certification requirements. In particular, our Information Security Officer and Director of Technology have relevant expertise in the areas of information security and cybersecurity risk management.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program to ensure that cybersecurity considerations are an integral part of our decision-making processes and are based on frameworks established by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and other applicable industry standards. In connection with our information security program, we perform ongoing internal and external risk assessment activities, and deploy systems, processes, and procedures across our global business units in response to identified risks. As cybersecurity events are detected via our global processes, the potential impact of the events is assessed based on criticality, and mitigation and remediation actions are taken in accordance with our incident response plan. The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises. Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.

companyName: GENUINE PARTS CO

ticker: GPC


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Our Adviser's cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party incident. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco Real Estate Income Trust Inc.


text: Non-technical safeguards also play an important role in our cybersecurity program. We provide various training programs and tools to employees so they can avoid risky practices and help us promptly identify potential or actual issues. We also have global incident response procedures, global service tools to log incidents and issues for investigation, and an ethics line to report concerns and follow up on matters already reported. The Compliance team, led by our Chief Technology Officer, develops and implements our strategy, as well as monitors systems and devices for risks and threats.

companyName: OneMedNet Corp

ticker: ONMD


text: We maintain various internationally recognized security certifications and aim to adopt best practices from industry-leading frameworks and standards for cybersecurity and cloud computing, including, without limitation, ISO 27001 certification, SOC 2, U.S. NIST Cybersecurity Framework (CSF), and the CIS Critical Security Controls. This does not imply that we have met any particular technical standards, specifications, or requirements, only that we use these frameworks, industry best practices, and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Our chief information security officers leads our incident response team for addressing and recovering from identified cybersecurity incidents. Our incident response team includes key members of our tech, legal and executive management teams to manage our response efforts, which includes timely compliance with applicable contractual and regulatory notification obligations.

companyName: COPART INC

ticker: CPRT


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: DURECT CORP


text: Alternus employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a dedicated cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. Alternus's cybersecurity team works in conjunction with the risk management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into Alternus's Information Security Policy, Alternus's information technology leadership reviews the company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into Alternus's Information Security Policy. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: expert input from both public and private partnerships;

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our Director of Information Technology and members of our cybersecurity committee (a management committee), which includes legal and privacy representatives, are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers. Our Director of Information Technology has expertise in security frameworks and standards (NIST), proficiency in security tools such as Security Information and Event Management) systems, Intrusion Detection Systems (IDS) and vulnerability scanners, and has experience with threat intelligence, threat modeling, risk assessment, and risk management practices as well as analyzing logs, investigating security incidents, and performing forensic analysis.

companyName: Arcellx, Inc.

ticker: ACLX


text: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls. We conduct penetration testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems. We also maintain a vendor risk management program designed to identify and mitigate potential risks associated with third-party suppliers and business partners. This program includes pre-engagement diligence, use of contractual cybersecurity and notification provisions, and ongoing monitoring of vendors, as appropriate.

companyName: Snap Inc

ticker: SNAP


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and routine employee awareness updates.

companyName: AmeriCann, Inc.


text: Our Audit Committee of the Board of Directors has the responsibility to review and discuss with management the Company's guidelines, policies, and governance with respect to financial risk exposures and enterprise risk management (including with respect to cybersecurity) and to regularly report to the full Board. Our Audit Committee also oversees our internal audit department and management's internal controls over financial reporting, including with respect to cybersecurity. Our Audit Committee receives regular presentations and reports on cybersecurity risks, progress on continued updates to The Company's cybersecurity procedures, as well as is made aware, on a timely basis, of any cybersecurity incidents deemed significant enough to be raised to their attention by management, as well as ongoing updates regarding any such incident until it has been remediated.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: Mr. Heasman has served as our CISO for over four years and has served in various roles in information technology and information security for over 20 years, including serving as the Deputy CISO of a large public company prior to joining Chegg. Mr. Heasman holds undergraduate and graduate degrees in engineering and computer science. Mr. Geiger holds an undergraduate degree in computer science and has served in various roles in information technology for over 30 years, including serving as either the CTO or Executive Vice President of Technology of four companies prior to joining Chegg. Our CEO, CFO and General Counsel each hold degrees in their respective fields, and each have over 20 years of experience managing risks at Chegg and other companies, including risks arising from cybersecurity threats.

companyName: CHEGG, INC

ticker: CHGG


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition from cybersecurity threats or prior incidents, such events have the potential to have a material adverse effect on such aspects of our business. Realization of these risks could damage or disrupt access to our information systems or networks, compromise confidential or protected information, destroy or corrupt data or otherwise interfere with our operations. We continuously monitor our networks for unauthorized access attempts and maintain a range of defensive measures. However, the evolving and sophisticated nature of cyber threats means we cannot guarantee prevention of all potential incidents that could materially impact our business operations, financial condition, or strategic objectives. In addition, even if we effectively defend our own systems, we rely on third-party providers of products, services and networks, with whom we share data and services, and who may themselves be unable to prevent or mitigate cyberattacks.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors".

companyName: Dolphin Entertainment, Inc.

ticker: DLPN


text: When a cybersecurity incident occurs, the Company prioritizes responding to and containing the threat and minimizing any business impact as appropriate. Each incident is evaluated, to determine the operational and financial significance, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact. An incident that reaches a specific level of severity is reported to the Cyber Incident Committee within pre-determined time frames. In such instance, the Cyber Incident Committee monitors the incident through resolution and post-incident analysis.

companyName: Westrock Coffee Co

ticker: WEST


text: Third Parties: Our management of third-party security risks is an area of heightened focus for us. Over the past several years, we have worked to formalize our security due diligence process for each acquisition target, such that security is a formally embedded component of our due diligence and typically involves our independent testing of the target technology prior to closing the acquisition. Where a vulnerability or risk is identified, we generally require remediation by the target or attempt to ensure a remediation path post-closing, with contractual protections and liability parameters set forth in the purchase agreement.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: As of June 30, 2024, we did not establish policies and processes for assessing, identifying, and managing material risk from cybersecurity threats.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: We rely heavily on third party partners (i.e. suppliers, subcontractors, consultants, etc.) to support our products, business operations and technology services, and a cybersecurity incident at a partner could materially adversely impact us. Where possible, we include information security provisions, audit rights and insurance requirements, in contracts with these partners based on their level of access to our systems and data. For our most critical partners, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select partners, we engage third party cybersecurity monitoring and alerting services, and seek to work directly with those partners to address potential deficiencies identified.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on an annual basis and subject to oversight by our board of directors.

companyName: Community West Bancshares

ticker: CWBC


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our third-party service providers, while our board of directors has responsibility for the oversight of risk management. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

companyName: Kraig Biocraft Laboratories, Inc.

ticker: KBLB


text: Management's Roles and Responsibilities Our cybersecurity response is handled by our information security team and managed by our Chief Information Security Officer (CISO), who reports to the Chief Financial Officer. Our CISO has over thirty years of business and technical experience in information risk, risk management, and regulatory compliance, including twelve years in a CISO role. Our information security team manages risks by establishing policies and procedures that manage information system access appropriately. These policies and procedures are tested through internal exercises and with external assistance and supplemented by training and communication to our employees and subcontractors.

companyName: MAXIMUS, INC.

ticker: MMS


text: While our management team is tasked with the day-to-day handling of risks facing our organization, the audit committee, as delegated by the board of directors and documented in the committee's charter, specifically oversees cybersecurity risk and governance. Management provides the audit committee regular updates covering information security issues, recent organizational developments and IT initiatives, vulnerability assessments, third-party evaluations, and emerging best practices. The audit committee also engages with our internal audit firm and other external specialists about organizational risks related to cybersecurity, as well as the policies and controls designed to mitigate these risks. In January 2024, our board of directors participated in a cybersecurity training session provided by our internal audit firm. Our audit committee or the board of directors is actively involved in strategic cybersecurity decisions, providing guidance and concurrence for significant or pervasive projects. This ensures that cybersecurity is seamlessly integrated into our strategic planning, aligning with our broader organizational goals.

companyName: ARGAN INC

ticker: AGX


text: Although we have experienced cybersecurity incidents from time to time that have not had a material adverse effect on our business, financial condition, or results of operations, there can be no assurance that a cyber-attack, security breach, or other cybersecurity incident will not have a material adverse effect on us in the future. For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to affect the company, see our risk factors, including the risk factors titled "Our strategy includes an increasing dependence on technology in our operations. If any of our key technology fails, our business could be adversely affected." and "A cybersecurity incident could negatively impact our business and our relationships with customers." in Item 1A of this Annual Report on Form 10-K.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: CEMTREX INC

ticker: CETX


text: Our information security organization safeguards the confidentiality, integrity, and availability of our systems, services, and data. We employ skilled security and technology professionals, both internal and external, and continually invest in the resources necessary to adapt and counter evolving cybersecurity threats. Our work is overseen by the Task Force (as defined below) for strategic guidance and accountability.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: Board of Director's Role The Company's Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data, including with respect to its associates and customers. The Board is responsible for the consideration and oversight of risk facing the Company and is also responsible for ensuring that material risks are identified and managed appropriately, including cybersecurity risks. The COO gives a monthly report to the Company's IT Steering Committee and Board on various information security issues. The Company has created and designated a separate committee of its Board as the Audit Committee consisting of four independent directors. The Audit Committee meets quarterly and reviews the Company's major financial risk exposures, including cybersecurity risks, and reviews the steps management is taking to monitor and control such exposures, including results of internal and external audits.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: The Company's cybersecurity risk management program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates, proactively scans for vulnerabilities, and engages qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. When vulnerabilities are identified, the Company's information technology ("IT") management team receives reports that assess each vulnerability and track progress in remediating that vulnerability. The IT management team also collaborates with supply chain management and the Company's third party risk management program to onboard and monitor key third-party service providers to address the potential risk of cybersecurity threats through the use of such third parties. Annual cybersecurity training is mandatory for all users with access to the Company's IT systems, and the Company conducts monthly tests to promote phishing awareness. In addition to these prevention methods, the Company seeks to detect potential threats through external intelligence and monitoring solutions. External commercial or governmental agencies are also engaged to assess potential threat activity relevant to the Company. The Company also monitors server and endpoint devices across the organization to detect signs of a cyberattack.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: In 2024, Brunswick did not identify any cyber events or risks from cybersecurity threats that could be considered material, individually or in the aggregate.

companyName: BRUNSWICK CORP

ticker: BC


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the board of directors approved Internal Audit plan.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outlines internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.

companyName: Gold.com, Inc.

ticker: GOLD


text: Information Security has significant experience in incident response, forensics, vulnerability management, network security administration, fraud prevention, and other governance, risk, and compliance areas. Information Security maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI-DSS, along with industry certifications commensurate with their roles.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. See "Item 1A. — Risk Factors — Failure to maintain the integrity of our information and information systems or comply with applicable privacy and cybersecurity requirements and regulations could harm our reputation and adversely affect our business." for more detailed information on cybersecurity risks and the potential impacts.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify reasonably foreseeable material risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from reasonably foreseeable cybersecurity threats; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • controls designed to identify, detect, assess and manage reasonably foreseeable cybersecurity threats associated with our use of key third-party service providers, suppliers and vendors with respect to our critical systems and data based on our assessment of how critical they are to our operations and respective risk profile.

companyName: FuboTV Inc.

ticker: FUBO


text: The Chief Information Officer (CIO) has primary operational responsibility for the Company's cybersecurity function. The CIO has served in various roles in information technology and information security for over 28 years with nine years' experience specifically in cybersecurity. The CIO, together with the Vice President of Information Security and Architecture – who has 20 years of cybersecurity experience and has maintained a Certified Information Systems Security Professional (CISSP) certification since 2008 – and the Chief Legal and Risk Officer have primary responsibility for assessing and managing material cybersecurity risks. This group, and their supporting teams, meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. This group also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: Sleep Number Corp

ticker: SNBR


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. As an externally managed company, our business is highly dependent on the communications and information systems of our Advisor, its affiliates and third-party service providers. Our Advisor is an indirect subsidiary of Cantor, a diversified organization specializing in financial services and real estate for institutional customers operating in the global financial and commercial real estate markets. Cantor has a global cybersecurity process applicable to all subsidiaries and business lines, including our business.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: Our CISO is primarily responsible for our cybersecurity risk management program and partners with our legal team on data privacy matters at the management level. Our CISO has over 25 years of experience in various technology leadership positions across multiple industries including finance, healthcare and technology. He has held leadership positions specifically in the information security space since 2011 at four publicly traded companies. The CISO's leadership team members are all seasoned information security professionals who have worked at some of the largest well-known brand names and are experts in their fields. Our CISO monitors, and participates in, our various cybersecurity policies and procedures, and our cybersecurity team regularly updates our CISO on the current status of the cybersecurity environment, and cybersecurity incidents and actual or potential risks. Our CISO and his team provide regular updates to the management team and escalate events that require leadership's attention.

companyName: UPWORK, INC

ticker: UPWK


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments for certain systems, systems monitoring for certain systems, access controls, asset management, and employee training. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example our managed security provider and professional services firms, including legal counsel.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: Our Vice President of Information Technology is primarily responsible for assessing and managing the Company's material cybersecurity risks, monitoring the effectiveness of our cybersecurity detection and response processes and providing updates on cybersecurity to our executive team. Our Vice President of Information Technology has more than 25 years of experience working in the field of information technology, including significant experience directing enterprise-level cybersecurity programs.

companyName: Sable Offshore Corp.

ticker: SOC


text: Our cybersecurity program includes: • a comprehensive cyber education program with ongoing employee cybersecurity awareness and training activities, which include frequent phishing simulation, testing, and ongoing education; • access management and access controls with periodic reviews; • protection of certain data through encryption at rest and in transit; • endpoint and network monitoring and protection software; • sensitive data transmission detection tools; • the engagement of a managed detection and response service which monitors the Company's environment at all times for threats, and in the event of an incident, provides proactive services; • a vulnerability management program that includes identifying and managing the cybersecurity risk associated with third-party service providers, including third-party software, hardware, and network infrastructure; • a dedicated internal cybersecurity team and a cyber incident response plan that provides controls and procedures to support appropriate identification, containment, response, investigation, reporting or and recovery from cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.

companyName: FOSTER L B CO

ticker: FSTR


text: Mitigating Third-Party Risk Because we are aware of the risks associated with third-party service providers, Rhinebeck Bank implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with strict cybersecurity standards.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with third-party service providers, including cybersecurity assessors, and consultants, in evaluating and testing our cybersecurity risk management systems. This enables us to leverage knowledge and insights with the goal of aligning our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: The Cybersecurity Governance Committee meets quarterly to review the processes and performance indicators related to prevention, detection, mitigation, and remediation of cybersecurity incidents that could adversely impact business operations.

companyName: Invitation Homes Inc.

ticker: INVH


text: The Company relies on third-party vendor solutions to support its operations. Many of these their-party vendors, especially in the financial services industry, have access to confidential, personal, sensitive and proprietary information. To mitigate the cyber, privacy and other operational risks associated with the use of third-party vendors, the Company maintains a third-party risk management program, which is implemented through a third-party risk management policy and includes a detailed onboarding process and periodic reviews of third-party vendors with access to confidential, personal, sensitive and propriety information. The third-party risk management policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in alignment with the Interagency Guidance on Third-Party Relationships: Risk Management. The third-party risk management program is audited periodically in accordance with our Board approved internal audit plan.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: The Company operates in blockchain and digital asset technology sector and the biotechnology sector, which are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including the loss or theft of private keys or breaches of our digital wallets; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We conduct periodic risk assessments using various tools and methodologies to identify and manage the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests, and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: BNB PLUS CORP.

ticker: BNBX


text: To advance and demonstrate our commitment to data security and privacy, we have achieved four cybersecurity-related certifications under standards promulgated by the International Organization for Standardization (ISO). Additionally, we are regularly audited and assessed pursuant to the System and Organization Controls (SOC 2) established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We regularly use the Cybersecurity Framework published by the National Institute of Standards and Technology–a framework of standards, guidelines, and best cybersecurity practices–to evaluate our security program and to plan improvement.

companyName: Samsara Inc.

ticker: IOT


text: To mitigate the occurrence of an incident as defined by the Company's formal documentation, which classifies and defines the properties of potential threats, the Company has in place a host of defenses which include, but are not limited to, the use of gateway consoles in all our global locations, limited access to key Information Systems from in-office networks or VPN with multi-factor authentication by means of a third-party mobile identity management tool to limit access to authorized users.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes in order to comply. • Conducting annual cybersecurity management and incident training for all employees of the organization. • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care. • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident. • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: AMEDISYS INC


text: Our operations include the creation, collection and maintenance of sensitive information, including proprietary and confidential business information, intellectual property, third-party information and employee information. To protect this information, we use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats on a constant basis. In addition, we use multi-factor authentication (MFA) for external use, perform penetration testing and engage third parties to assess the effectiveness of our cybersecurity practices. We conduct a thorough risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implement strategies to mitigate these risks and their possible impacts. We establish incident response plans and provide cybersecurity training to our employees and monitor their activity to ensure adherence to our security protocols. A material cyber-attack on our systems, or any other third-party partners or vendors and their key operating systems, may interrupt our ability to operate our business, damage our reputation, or result in monetary damages.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Our cybersecurity incident response plan is designed to actively monitor and escalate certain cybersecurity incidents to members of management depending on the circumstances, including our chief financial officer and general counsel. Management works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the Board of Directors for certain cybersecurity incidents.

companyName: LUMOS PHARMA, INC.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: The CISO has served in various roles of increasing responsibility in information technology and information security for over 30 years and has attained several relevant professional certifications. The CIO has also served in various roles in information technology for over 25 years, including as chief information officer at another public company, and has extensive experience managing cybersecurity threats.

companyName: HERC HOLDINGS INC

ticker: HRI


text: A management level risk committee exists and oversees the management of the Company's highest-level risks, including cybersecurity. This committee consists of representatives from the Risk, Financial, Underwriting, Information Technology and Legal Departments. The Risk Committee, as supported by the Cybersecurity Committee, is responsible for keeping the audit committee apprised of the Company's cybersecurity preparedness and cyber incidents. The Cybersecurity Committee oversees and ensures the Company's cyber-related controls are sufficient to protect the Company's information and proprietary assets, in accordance with the acceptable risk policies and risk tolerances.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: As part of the above approach and processes, we have engaged assessors to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: BioAtla, Inc.

ticker: BCAB


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats as may be appropriate; conducting threat assessments of both internal and external threats; conducting risk, threat and vulnerability assessments to identify vulnerabilities; working with third parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: We have an enterprise-wide cybersecurity program that provides governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program aligns with leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, to enhance our ability to focus resources appropriately.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: Our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified information systems security professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experience.

companyName: Lucid Group, Inc.

ticker: LCID


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2023. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: In addition, our board and/or the Security/Technology Committee receives regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. In addition, the CISO provides prompt and timely information on any cybersecurity or information security incident that may pose significant risk to us and continues to provide regular reports on any such incident until its conclusion.

companyName: Federal Home Loan Bank of Indianapolis


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Advisor routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Advisor and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Advisor uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Advisor or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The members of management who are primarily responsible for assessing and managing our material risks from cybersecurity threats are Brad Jones, our Chief Information Security Officer, and Grzegorz Czajkowski, our EVP, Engineering & Support. Mr. Jones joined Snowflake in 2023 and previously served in various cybersecurity roles for over 12 years across multiple technology sectors, including manufacturing, software, and services. Mr. Jones reports to Sunny Bedi, who has served as our Chief Information and Data Officer since 2020 and, prior to joining us, served as VP of Corporate IT / Head of Global IT at NVIDIA, where his responsibilities included managing IT security. Mr. Czajkowski joined Snowflake as SVP, Engineering & Support in 2019 and, prior to joining us, served in various roles at Google, including as VP Engineering where he was responsible for a portfolio of Google Cloud data analytics and for internal services addressing data analytics needs of Google's businesses. Each of Messrs. Jones and Czajkowski is responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Snowflake Inc.

ticker: SNOW


text: through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care and enter into confidentiality agreements, and enter into data processing agreements with third parties that are processing personal data we control;

companyName: Profound Medical Corp.

ticker: PROF


text: Once a cybersecurity incident has been identified, the SOC team performs an initial investigation to determine if the incident is deemed high or low severity, based upon the business and operational impacts. Any incident deemed high severity would result in notification by the CISO to the Cyber Lead team to determine the appropriate actions to be taken. This determination would be made by the Cyber Lead team based on both qualitative and quantitative factors regarding the extent and magnitude of the incident. If the incident is then escalated to the Disclosure Committee and determined to be material, a disclosure via a Current Report on Form 8-K would be made within four business days of the incident being identified as such. Through December 31, 2023, there have been no cybersecurity incidents deemed to have had a material impact on our results of operations or financial condition. Our Board of Directors would also be notified of any high severity incidents that are determined to be material, concurrently with the notification to the Disclosure Committee, and would be kept apprised of actions taken in response to such incidents.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: We assess the effectiveness of our corporate policies and controls internally, as well as through the engagement of external advisors to conduct regular reviews, penetration tests, and vulnerability scans of Company information systems and applications. Results from these assessments help inform updates to risk assessments, changes to security controls and processes, and updates to policies and standards as appropriate. We employ a variety of internal measures to detect, prevent, and reduce the frequency and severity of cybersecurity incidents on the Company's infrastructure, which may include, but are not limited to, the use of encryption, intrusion prevention, endpoint security, password protection, multi-factor authentication, internal phishing testing, security awareness training, and vulnerability scanning and penetration testing.

companyName: GLOBE LIFE INC.

ticker: GL


text: The Company's Global Director of Information Security & Compliance (the "GDISC") is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management programs, in partnership with business and functional leaders across the Company. The GDISC has 22 years of experience in the information technology and cybersecurity field, including previous roles in cybersecurity leadership, governance, and technology architecture and engineering. The GDISC reports to the Company's Chief Information Officer (the "CIO"), who reports directly to the Senior Vice President, Chief Financial Officer. The CIO has 24 years of experience in the information technology and cybersecurity field, including previous roles in security architecture, audit, compliance, and governance.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: We maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats and to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our customers and employees.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Cybersecurity Program Overview The Investment Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us and to protect the systems, data and other digital assets of the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD