text: Board Oversight of Risks from Cybersecurity Threats Our Board believes that evaluating management's oversight, administration, and governance of the risks confronting the Company, including risks related to cybersecurity, is one of its most important areas of oversight. In carrying out this responsibility, the Board is assisted by each of its standing committees, which each considers risks that are within its areas of chartered responsibility, and each of which apprises the full Board of any significant risks which are considered by the committee and management's response to those risks. The Audit Committee of the Board ("Audit Committee") is charged with the primary responsibility for overseeing our design, execution, and administration of our ERM process and, with regard to cybersecurity risks, setting expectations and accountability for management and reviewing our internal auditors' assessment of the effectiveness of our cybersecurity controls, including policies and procedures to address our cyber risks, and overseeing the Company's cybersecurity disclosures. The Audit Committee receives semiannual updates, and the Board receives annual updates, from our senior executive team (including our CITO and the SDIS) on our cybersecurity risks, threats, and initiatives including evolving cybersecurity threats and trends, cybersecurity technologies and solutions that have been deployed internally, policies and procedures to address major cyber risk areas and threats to the Company, third-party assessments of the adequacy of our cybersecurity resources, and attendance by members of our information security team at various seminars and conferences on emerging cybersecurity risks and threats. In addition to these regular updates, the Audit Committee or the Board may receive additional updates if deemed appropriate.

companyName: Schneider National, Inc.

ticker: SNDR


text: Our cybersecurity program is designed to detect cybersecurity threats and vulnerabilities, protect our information systems from such threats, and ensure the confidentiality, integrity, and availability of systems and information used, owned or managed by us. Our focus is on protecting sensitive information, such as personal information of our customers and employees, and confidential business information that could be leveraged by a competitor or a malicious actor.

companyName: Hawkeye Systems, Inc.

ticker: HWKE

secItem: Item 1C


text: The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments.

companyName: LXP Industrial Trust

ticker: LXP


text: Third-Party Risks We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Our risk mitigation strategy focuses on measures to prevent, detect, and respond to cybersecurity incidents. The primary components of our risk mitigation strategy include: • Security Controls: We maintain a comprehensive set of controls aligned with industry standards such as the National Institute of Standards and Technology ("NIST") and the International Organization of Standards ("ISO") 27001 to protect our systems, networks, and data. • Incident Response Plan: We have a well-defined incident response plan that outline roles, responsibilities, and procedures for handling cybersecurity incidents. • Employee Training and Awareness: We have training programs to ensure that our employees understand their role in maintaining a secure environment and recognize potential threats. • Third-party Risk Assessment and Management: We assess and manage cybersecurity risks associated with our vendors, partners, and service providers.

companyName: ICF International, Inc.

ticker: ICFI


text: The Company's internal audit team annually assesses and reviews the risks posed to the security of the networks used by the Company, including a review of system and process assurance for information technology and application controls, and takes into account certain frameworks and policies. The Company's internal audit team also reviews the Company's fraud assessment and confirms IT management's oversight of its cybersecurity policies. The Company's management team reviews the findings, if any, of these assessments, assesses the identified risks and takes action based on the Company's risk profile. In order to assess the risks posed to the information systems by third-party service providers and vendors, the SITE Centers' information technology department, coordinating with the Company's internal audit services team, evaluates and implements, as appropriate, new software and network application vendors' contracts, internal policies, certifications and System and Organization Controls ("SOC") reports during the procurement of solutions and services.

companyName: Curbline Properties Corp.

ticker: CURB


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage tabletop exercises, penetration and vulnerability testing, and third-party red team exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also engage an external auditor to conduct annual Security and Organizational Controls 2 (SOC 2) examination of the security controls for systems storing customer data. The external auditor also conducts an annual payment card industry (PCI) data security standard review of our security controls protecting payment information, as well as third-party penetration testing of our cardholder environment and related systems.

companyName: AGILYSYS INC

ticker: AGYS


text: Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE OF NEW JERSEY


text: In 2020, the Company's Board of Directors approved the implementation of a three lines of defense enterprise risk management framework upon the hiring of our current Chief Risk Officer/Chief Information Security Officer ("CRO/CISO"). Our three lines of defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.

companyName: Capital Bancorp Inc

ticker: CBNK


text: The SVP-IT regularly reports to our senior leadership team, as well as periodically to our Board of Directors, regarding our cybersecurity program and material cybersecurity risks. The SVP-IT coordinates with other teams including internal Audit, to ensure a combined focus on technology modernization and remediation needs. The SVP-IT is briefed weekly on current security operations and relevant issues across the cybersecurity threat landscape.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of third-party service providers, including cybersecurity assessors, and consultants, in evaluating and testing our cybersecurity risk management systems. This enables us to leverage knowledge and insights with the goal of aligning our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: are responsible for discussing material cybersecurity incidents or threats with specific constituencies before sign-off, ensuring thorough review of information and disclosures. The CEO and CFO are also responsible for assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident, maintaining oversight of the disclosure in the periodic reports (including our annual reports on Form 10-K) of the Company.

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: The board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Technology Director and Chief Information Security Officer provide annual reports to the board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the board of directors reviews our cybersecurity risk profile on a quarterly basis.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: Our approach encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. Identity and access management serves as an integral part of our strategy and involves access controls and authentication methods. Data protection and privacy practices, including data loss prevention, safeguards sensitive information. We also deploy cybersecurity systems, such as firewalls, intrusion detection systems and continuous monitoring, to provide defenses against unauthorized access. Incident response exercises are regularly performed to ensure readiness for potential cybersecurity incidents. Employee training and awareness programs are conducted to minimize risks associated with human error and foster a culture of security consciousness. Finally, vendor risk management practices are employed and focus on monitoring the posture of our third-party vendors to mitigate risks from external sources. In addition, we perform user access reviews for third-party applications, and for certain applications, obtain and review System and Organization Controls reports to assess our critical vendors' cybersecurity preparedness both at inception and on an ongoing basis.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") as well as International Organization for Standardization ("ISO") 27001. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: NOVANTA INC

ticker: NOVT


text: Our Chief Information Officer, reporting to our Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the activities and systems necessary to address such risks and threats and preparing updates for the Board of Directors. Our Chief Information Security Officer reports to our Security Leader and has over 25 years of IT, cybersecurity, data security and regulatory compliance experience. Our Security Leader reports to our Chief Information Officer, and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Security Leader has 20 years of IT experience.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: risk metrics and self-assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Our Chief Security Officer reports to the Chief Technology Officer and works closely with the Chief Legal Officer to ensure that all disclosure or reporting requirements are satisfied if an incident were to occur. The Chief Security Officer leads Parsons' overall cybersecurity function and provides quarterly reports to the Audit and Risk Committee on our cybersecurity risks, including briefings on our cybersecurity risk management program and cybersecurity incidents. The Audit and Risk Committee also receives periodic presentations on relevant cybersecurity topics as part of the Committee and the Board's continuing education on topics that impact public companies.

companyName: PARSONS CORP

ticker: PSN


text: The interim CEO and CFO communicate with the head of the information technology department daily to monitor any potential or perceived threats to our technology infrastructure. A comprehensive and regularly tested Incident Response Plan (IRP) has been established that outlines specific steps for various types of cyber incidents. There are key performance indicators (KPIs) and metrics used to measure the effectiveness of the cybersecurity program, including processes to keep senior management and the Board's Audit Committee informed. The Company also maintains a cybersecurity insurance policy to provide financial protection in the event of a critical breach.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We engage a third-party to provide operational support for cybersecurity risks. This forms a critical part of our risk management strategy, facilitating effective management and mitigation of risks, and ensuring adherence to applicable regulatory and industry standards.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: We are committed to protecting the confidentiality and integrity of our data, as well as the data of our customers. The mission of our cybersecurity program is to protect the assets used to generate revenue and serve customers while complying with industry frameworks and best practices. Our cybersecurity program consists of cyber defense, governance and compliance, and risk management. Each area has tools, controls, and processes aligned with the National Institute of Standards and Technology Cyber Security Framework.

companyName: Research Solutions, Inc.

ticker: RSSS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, with the oversight of our Chief Financial Officer. Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our VP of IT, in consultation with our Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our VP of IT has nearly 25 years of relevant experience, including leadership roles in the information technology departments of public and private companies. Prior to joining the Company, he served as VP of IT for another public company in the consumer packaged goods industry.

companyName: Vital Farms, Inc.

ticker: VITL


text: In the event of the detection of an actual or suspected cybersecurity incident, the Company's IT Team, lead by the IT Manager, assesses the incident as "minimal", "low", "moderate" or "high". Incidents assessed at a minimal or low risk are reported to Company's management and the Executive Chairman of the Board and the Executive Chairman of the Board may share this information with the Board. Incidents assessed at a moderate or high risk are reported to Company's management, the Executive Chairman of the Board, and the Company's Board of Directors.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology ("NIST")'s Cybersecurity Framework ("CSF") and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our solutions, systems, websites and the data on these sources have been in the past and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales." included as part of "Risk Factors" in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Gen Digital Inc.

ticker: GEN


text: Network/System Security of OT from IT and User Networks: We ensure our OT systems are physically or logically separated from corporate IT networks, reducing the risk of cross-contamination. Device Hardening: We enhance security by disabling unnecessary ports, services, and protocols, minimizing potential attack surfaces. ensure data Encryption in transit and at rest.

companyName: Health In Tech, Inc.

ticker: HIT


text: To the best knowledge of management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: Financial Impact: Cybersecurity incidents may result in direct financial losses, such as fraud-related expenses, remediation costs, and legal fees, as well as indirect costs associated with business interruption and reputational damage. Regular risk assessments and vulnerability testing of systems and networks. Deployment of advanced cybersecurity technologies, including firewalls, intrusion detection systems, and encryption protocols. Employee training and awareness programs to enhance cybersecurity awareness and promote best practices. Incident response and business continuity plans to ensure a timely and effective response to cybersecurity incidents.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: ACTUATE THERAPEUTICS, INC.

ticker: ACTU


text: Legal Sign-off 2.24.25 The risk management program is primarily focused on safeguarding the organization's digital assets, ensuring continuous business operations, and minimizing the potential impact of cyber threats. The structured risk management process is designed to comprehensively identify and assess risks, implement effective mitigation and remediation strategies, enhance overall cybersecurity resilience, and provide transparent reporting. Continuous risk assessments are conducted through internal evaluations and routine engagements with independent third-party security services organizations to systematically identify, prioritize and manage information security risks. Subsequently, risk mitigation strategies are developed and executed to address and remediate identified risks effectively through new cybersecurity initiatives and ongoing enhancements to the cybersecurity program. Regular audits and assessments, including penetration tests and attack simulations, are performed both internally and through independent third-party consultants, and internal auditors evaluate the operational effectiveness of cybersecurity controls and risk management measures. These inputs form the basis of a risk register that is integrated into the overall enterprise risk management program to further inform the Company's strategy assessing the likelihood, impact, and velocity of these risks on a forward-looking, multi-year mitigated basis. A formal process exists grounded in the enterprise risk management program where material risks, interdependencies, and the associated remediation plans that are tracked to completion at a minimum on a monthly basis are presented and discussed cross-functionally. In addition to the normal discourse on emerging risks, a focused drill down into cybersecurity risk is presented annually at the enterprise risk steering committee meeting.

companyName: XEROX CORP


text: Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.

companyName: SLM Corp

ticker: SLM


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Director of Operations & Information Technology, who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Director of Operations & Information Technology.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST CSF.

companyName: InnovAge Holding Corp.

ticker: INNV


text: We use, store and process data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Information Security Policy and Risk Management: The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors. The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually and also receive periodic reports on cyber/information security topics and matters.

companyName: BankFinancial CORP


text: Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "Audit Committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager should take, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our Audit Committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the Management Agreement, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA Information Technology and Cybersecurity Team, including the ORIX USA Chief Technology Officer ("CTO"), to provide us with a comprehensive cybersecurity risk management program.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: The Company recognizes that cybersecurity is not solely a technology issue but also a people and process issue. We plan to invest in ongoing training and awareness programs to empower our team to recognize and respond to potential security threats effectively.

companyName: International Land Alliance Inc.

ticker: ILAL


text: Our organization-wide information security program focuses on implementing effective and efficient controls, technologies, and other processes to help protect, identify, assess, manage and mitigate material cybersecurity threats and incidents. These processes include, among other things, regular testing of these controls through table-top exercises, penetration and vulnerability testing, auditing of our information security by an independent third-party auditor, ongoing security awareness training for employees and other educational programs, and continuous monitoring of our cybersecurity posture. We also employ numerous tools including, but not limited to, segregated layers of controls for access to our systems and security tools that help identify, isolate, remediate, and recover from identified vulnerabilities and security incidents in a timely manner. Our cybersecurity posture is managed by both our information security organization and through partnerships with industry recognized cybersecurity firms.

companyName: Freshpet, Inc.

ticker: FRPT


text: Cybersecurity risk management will be an integral part of our overall enterprise risk management efforts once the Company has determined how and what security measures will need to be deployed. No enterprise risk can be eliminated entirely. We will seek to mitigate as much risk as possible and manage the remaining financial risk through a cyber insurance policy. The Company has chosen the National Institute of Standards (NIST) for its base framework because it is compatible with certain risk management business functions required by customers and US Government oversight. Controls in the SP 800-53 catalog will be tailored-in based on governance found in SP 800-171, internally determined IT General Controls and industry best practices to create a balanced approach protecting confidentiality, integrity, and availability.

companyName: FinTrade Sherpa, Inc.

ticker: FTSP


text: For the year ended March 31, 2024 and through the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a description of how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations or financial condition, see "Item 1A. Risk Factors - Information technology failures and data security breaches, including as a result of cybersecurity attacks, could negatively impact our results of operations and financial condition, subject us to increased operating costs, and expose us to litigation".

companyName: DORIAN LPG LTD.

ticker: LPG


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented trainings designed to provide best practices for protecting our network and systems, and also routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: For additional information regarding how cybersecurity threats could potentially materially affect our business strategy, results of operations, or financial condition, see Part 1, Item 1A "Risk Factors – Risks Related to Information Technology." Interruption, interference with, or failure of information technology systems could hurt our ability to effectively provide our product and services, which could harm our reputation, financial condition, operating results, and cash flows.

companyName: QXO BUILDING PRODUCTS, INC.


text: Westwood's Board is responsible for overseeing the effective execution of our overall cybersecurity programs. Along with management, our Board reviews our cybersecurity efforts and programs and is informed of cybersecurity risks primarily through discussions with management, trainings and exercises.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: We have established a cybersecurity governance framework to ensure effective oversight, accountability, and strategic alignment across the organization. The Audit Committee of our Board of Directors oversees cybersecurity-related risks as part of its broader risk management responsibilities. The Audit Committee of the Board of Directors receives periodic reports from executive management and external cybersecurity advisors on our security initiatives, emerging threats and risk mitigation efforts.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— General Risk Factors— Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."

companyName: Chatham Lodging Trust

ticker: CLDT


text: We do not believe that there are currently any known risks from cybersecurity threats that have affected, or are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: The Company relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade information security management program designed to identify, protect, detect and respond to and manage reasonably foreseeable material cybersecurity threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: HELEN OF TROY LTD

ticker: HELE


text: The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in the section entitled "Item 1A. Risk Factors" in this Annual Report.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. BIOLASE acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: BIOLASE, INC


text: The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends. The cybersecurity program is executed with the MSSP, which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; and the Director of Corporate Security. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.

companyName: CONTINENTAL RESOURCES, INC


text: The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, which it administers in part through its Audit Committee. One of the Audit Committee's responsibilities involves reviewing the Company's policies regarding risk assessment and risk management, including with respect to cybersecurity risks. Risk oversight plays a role in all major decisions of the Company's Board of Directors, and the evaluation of risk is a key part of its decision-making process.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: In the event of a cybersecurity event, a cross-functional steering committee involving the IT, Finance, and Legal departments, would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate.

companyName: Karat Packaging Inc.

ticker: KRT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors — Operational Risks for additional disclosures with regard to the possible impact of future cybersecurity threats or incidents.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. For further information, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factors entitled "Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to our Business: Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, or use or other processing of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: The Risk Management Committee of the Board coordinates with the Board and other Board committees regarding the assignment to the Board and Committees of oversight responsibilities for all identified key risks to the Company. Risks related to cybersecurity are overseen by the BTTC. The BTTC monitors cybersecurity risks associated with both internal and external actors, including third-party vendors and service providers. Additional information about the BTTC's role in overseeing risks related to cybersecurity and information technology generally can be found in the Committee's Charter at mtg.mgic.com/corporate-governance/highlights.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise incident response plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: CYBER RISK MANAGEMENT AND STRATEGY BHE and its Subsidiary Registrants recognize that maintaining processes for identifying, assessing and managing cybersecurity threats is important in dealing with their significant business risks. As such, BHE has implemented a framework for cybersecurity and cyber-related information management across its businesses. BHE's Chief Security Office ("CSO") drives collective focus and central coordination of BHE's cyber and physical security programs. The CSO identifies the strategic framework that promotes standardization of business security policies and practices and provides direction in managing security risks. Although the CSO provides oversight, the businesses retain accountability for executing company security objectives, policies and practices within their areas of responsibility.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: The Company interacts with the information technology networks and systems of third parties for many aspects of our business. We consider and evaluate cybersecurity risks associated with the use of independent third-party service providers. To help UPS understand and mitigate potential cybersecurity risks related to third parties, we generally utilize measures such as vendor risk assessments, periodic technical assessments of third-party vendors' controls and contracts governing the use of and access to our data and compliance with our security requirements.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity threats and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Texas Roadhouse, Inc.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight of management's assessment and mitigation of risks from cybersecurity threats.

companyName: CS Disco, Inc.

ticker: LAW


text: We have structured our cybersecurity risk management program according to the National Institute of Standards and Technology Cybersecurity Framework. We strive to employ cybersecurity best practices, including implementing new technologies to proactively monitor new threats and vulnerabilities and reduce risk; maintaining a Cybersecurity Incident Response Plan, Disaster Recovery Plan, and Business Continuity Plan; and regularly updating our response planning and protocols. We have integrated our cybersecurity processes into our overall risk management program, thereby establishing a comprehensive approach by which we determine and implement strategies designed to manage external, strategic, operational and financial risks to our business, including cybersecurity threats.

companyName: SM Energy Co

ticker: SM


text: Our Chief Information Officer, Vice President of Cybersecurity and Information Security, Engineering, Legal, Risk Management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example automated and manual tools, third party threat assessments and intelligence feeds, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, performing internal and external audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, and conducting red/blue team testing and tabletop incident response exercises jointly with external third parties.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. The expenses we have incurred from cybersecurity incidents, including the Vendor Incident have been immaterial to date. Nevertheless, we also believe risks from certain cybersecurity threats, including as a result of our previously disclosed Vendor Incident could potentially result in charges, settlements or other potential liabilities that could materially affect our business strategy, results of operations, and financial condition, depending on the outcome of pending lawsuits as discussed further below.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: b. Monitoring of all IT assets, resources, and data 24-hours per day, 7-days per week, 365-days per year by security operations center (SOC). c. Performing annual testing of the Company's incident response plan and cybersecurity posture by a third party.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: We have established comprehensive incident response and recovery plans and intend to test and refine the effectiveness of those plans under the leadership of the Chief Human Resources Officer, who is accountable for the overall business continuity program at UFG. Our incident response and recovery plans address and guide our employees, management, and the Board of Directors on our response to a cybersecurity incident, including the requirements of notification, classification, analysis and communication of cybersecurity incidents based on the identified severity level. The ERM Committee is accountable for regularly reviewing and evaluating the corporate incident response plan and business continuity plan.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Cybersecurity risks are categorized using a Critical, High, Medium, and Low risk scoring methodology. These assessments are performed through a combination of automated tools, manual audits, and expert evaluations, allowing us to implement effective controls that enhance our security framework. In addition, we have introduced annual cybersecurity awareness training, phishing simulations, and ongoing communication initiatives to strengthen organizational awareness of cybersecurity risks and threat prevention. To date, we and our subsidiaries have not experienced any material cybersecurity incidents.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

companyName: T Series Middle Market Loan Fund LLC


text: Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes designed to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions.

companyName: Spirit AeroSystems Holdings, Inc.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled "We rely significantly on information technology, and any compromise or interruption of that technology resulting from cybersecurity incidents, data security breaches, design defects or system failures could have a material negative impact on our business" in Part I, Item 1A of this Report for additional information about the risks associated with cybersecurity threats.

companyName: YETI Holdings, Inc.

ticker: YETI


text: The Audit Committee of our Board of Directors is responsible for assisting the Board in overseeing the Company's risk assessment and risk management processes, including risks related to cybersecurity and data privacy. Our Head of Security, who reports to our Head of Engineering and works with other members of management, manages the Company's cybersecurity program. Our Head of Security holds a master's degree in computer engineering from the Rochester Institute of Technology and has over 15 years of cybersecurity experience. Our Head of Engineering holds a master's degree in computer science from the University of Illinois Urbana-Champaign and has nearly two decades of leadership experience at technology companies overseeing key engineering functions. Our Head of Security provides regular updates to the Audit Committee and the Board on cybersecurity risks faced by the Company and the Company's processes for risk identification, assessment, and management.

companyName: Asana, Inc.

ticker: ASAN


text: It is inevitable that additional cybersecurity incidents will occur in the future and any such cybersecurity incident could result in significantly harmful consequences to the Bank, the Bank's members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service the Bank's members and protect the privacy of the data their customers have entrusted to us, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of New York


text: Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the service provider, we take various measures designed to help manage cybersecurity risk associated with our use of third-party service providers, which may include due diligence; monitoring of cybersecurity threat risks identified through such diligence in connection with our use of third-party service providers; and imposing certain contractual obligations.

companyName: PATTERSON COMPANIES, INC.


text: Company currently engages third parties in connection with our China cybersecurity annual assessment overseen by our IT Manager, which is driven by risk ranking and assessment. Cybersecurity considerations for operations outside of China, which includes a small proportion of core functions as well as administrative functions, are incorporated in the Company's overall risk assessment and will be considered in the overall SOX/controls management testing going forward when appropriate. Recognizing the importance of cybersecurity from both an operational and disclosure perspective, as well as the complexity and evolving nature of cybersecurity threats, we plans to revisit the link between China cybersecurity testing and FingerMotion's consolidated cybersecurity risk assessment and consider potential enhancements. FingerMotion will consider resource and capital constraints when determining the nature and timing of enhancing our cybersecurity infrastructure.

companyName: FingerMotion, Inc.

ticker: FNGR


text: We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer ("CISO"). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework ("NIST CSF"), Payment Card Industry Data Security Standards ("PCI DSS"), the Center for Internet Security ("CIS") Critical Security Controls, the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, and relevant International Organization for Standardization ("ISO") standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes: A security testing schedule, which includes internal/external penetration testing; Regular vulnerability assessments; Detailed vulnerability management; 24/7 Security Operations Center Monitoring and reporting of systems and critical applications; Data loss prevention controls; File access and integrity monitoring and reporting; Threat intelligence; Third-party vendor management.

companyName: Bancorp, Inc.

ticker: TBBK


text: With the help and guidance of a vendor partner, we conduct quarterly end-user training campaigns designed to educate our end-user community on the social engineering methods used by sources of cybersecurity threats. In addition, monthly security updates are provided to the end-user community with information on current threats and general cybersecurity information.

companyName: SURMODICS INC

ticker: SRDX


text: Through this tiered reporting structure, we ensure that critical cybersecurity information reaches the appropriate levels of management and that the board of directors is kept fully informed on material risks and incidents. Our approach ensures that we maintain a vigilant and responsive posture towards cybersecurity, embodying a culture of continuous improvement and accountability at all levels of our organization.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program. This includes monitoring our networks and systems for indicators of compromise ("IOCs"), active intrusion attempts, and other suspicious activity, including insider threat risks. The cybersecurity team stays apprised of existing and emerging cybersecurity threats through commercial threat intelligence feeds and by partnering and data sharing with third parties such as the U.S. government, law enforcement agencies, customers, and other Defense Industrial Base ("DIB") participants. We also engage third parties to conduct evaluations of our cybersecurity controls by performing penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers and suppliers.

companyName: AeroVironment Inc

ticker: AVAV


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: We also expect our suppliers and third party service providers to follow the same industry-standard security practices that we follow. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. The ability and availability of information to monitor the cybersecurity practices and controls of our suppliers and third party service providers is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in information systems, software, networks, and other assets owned or controlled by our suppliers and third party service providers. Although the Company attempts to manage its exposure to such events through the purchase of cyber liability insurance, such events are inherently unpredictable, and insurance may not be sufficient to protect the Company against all losses. There is no assurance that the Company's security systems or processes will prevent or mitigate future break-ins, tampering, security breaches or other cyber-related attacks.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: Material Effects from Risks of Cybersecurity Threats While we may experience minor data and cybersecurity incidents from time to time, to our knowledge, the risks posed by cybersecurity threats have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. A successful cybersecurity attack may expose us to misuse of information or systems, the compromising of confidential information, manipulation or destruction of data, production downtimes, and operations disruptions.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: We have employed a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. The Bank conducts a variety of information security risk assessments throughout the year. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including but not limited to, configuration hardening, robust patch management and vulnerability scanning, advanced anti-malware firewall technologies, anti-phishing and web filtering controls. These controls are tested annually by an independent third-party audit firm. Quarterly employee training is performed on cybersecurity, information security, identify theft prevention and data privacy.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Maintaining and improving our cybersecurity capabilities is a high priority for our business. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as National Institute of Standards and Technology (NIST) and Federal Financial Institutions Examination Council (FFEIC), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Following these risk assessments, we evaluate how to reasonably address identified gaps in existing safeguards to minimize identified risks and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high level personnel, including our Head of Information Security and Compliance, to manage the risk assessment and mitigation process.

companyName: AppLovin Corp

ticker: APP


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function. Alight employees are assigned data privacy and security training upon on-boarding and annually thereafter. The training is designed in collaboration with a third-party service provider and is designed to raise awareness of security practices and to educate employees on how to protect information and infrastructure.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: The Company's management is responsible for assessing and managing material risks from cybersecurity threats, in consultations with cybersecurity consultants. The compliance team of the Company will maintain effective disclosure controls and procedures to ensure timely identification, consideration, and disclosure of material cybersecurity incidents, including through timely reporting to management and the Board. The Chief Compliance Officer, in consultation with the IT Consultant, will periodically determine whether the Company requires additional information technology or cybersecurity support.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: management and strategy recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and protect the confidentiality, integrity, and availability of our data. We have established policies and procedures to assess, identify, and manage material risk from cybersecurity threats. We assess risks from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats.

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee the oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to cybersecurity threats and our processes for assessing, identifying, and managing material risks from cybersecurity threats, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. Our board of directors and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our client or employee data or our systems. Cybersecurity considerations affect the selection and oversight of our third-party service providers. Although we perform diligence on third parties and monitor cybersecurity threat risks identified through such diligence, we cannot guarantee that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties.

companyName: MSCI Inc.

ticker: MSCI


text: All committee activities are reported to the Board's Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Change and Configuration Management Our change and configuration management policy and procedures enable the effective management of changes to Information Systems ("Changes") to ensure the confidentiality and integrity of Information Assets and the continued availability of both the Information Systems and information technology ("IT") services. The policies and procedures apply to all changes to Information Systems managed by the Company or its IT external business partners.

companyName: Clene Inc.

ticker: CLNN


text: In addition, the Company's information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security. Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: Cybersecurity Incident Response Plan—In addition to protecting our assets proactively, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management and our board of directors. The cybersecurity incident response team is composed of a smaller, core group of our cybersecurity team, as well as a larger, extended group that includes personnel from our operations, legal, compliance, privacy, risk management, communications, incident command center, security, human resources, finance, audit and government relations teams. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management in accordance with our plan and as otherwise appropriate based on the nature of the incident.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: The Information Technology department is responsible for implementing and maintaining the Bank's cybersecurity risk management program. The Information Technology department consists of cybersecurity and information risk professionals who assess, identify, and manage cybersecurity risks. Information Security is led by Chief Information Technology Officer, who reports directly to the Chief Operating Officer and dotted lined to the Board of Directors. The Bank's CITO has over 23 years of experience in technology and cybersecurity across the financial services industry. Prior to joining the Bank, the Bank's CITO served as Chief Information Officer and Information Security Officer at First Choice Bank and the Director of Technology and IT Governance at OceanFirst Bank. The Information Technology department is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities. Information security risk is reported by the Information Technology Department through quarterly management reporting to achieve an appropriate flow of information risk reporting to the Board. The committees and working groups that monitor information security risks include the Cybersecurity Incident Response Team, and the Information Technology / Information Security Committee of the Board of Directors. These committees and working groups establish and oversee policies, programs, and other guidance to provide specific expectations for managing the cybersecurity risk.

companyName: BCB BANCORP INC

ticker: BCBP


text: The Company has not experienced any material cybersecurity breach in the years ended December 31, 2024, 2023 and 2022. The Company also has not incurred any net expenses from penalties and/or settlements from any material cybersecurity breaches during the years ended December 31, 2024, 2023 and 2022.

companyName: MAXLINEAR, INC

ticker: MXL


text: Our CIO routinely apprises our CFO regarding cyber risk management activities and provides updates and data, as needed, to our executive team to facilitate decisions regarding our cyber risk posture and related considerations regarding our enterprise risk management assessment. Our CIO and CFO provide to the Audit Committee of our Board of Trustees: quarterly updates on our cybersecurity risk management strategy and related activities; annual reviews of our cyber risk assessment; and other information as needed to facilitate the committee's oversight of our cybersecurity risk. Two members of this committee possess technology and cybersecurity experience, which we believe brings valuable insight and perspective to our risk management strategy. Our CIO and CFO also provide an annual review of our cyber risk assessment to our full Board of Trustees.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our processes also address cybersecurity risks associated with our use of third-party service providers used in different capacities to provide or operate some of our cybersecurity controls and technology systems. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments and external monitoring sources, including performing dark web analyses, to better inform us during contracting and vendor selection processes. Security issues are documented and tracked, and periodic monitoring of third parties is conducted in an effort to mitigate risk. In addition to the processes, technologies, and controls that we have in place that are designed to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), we have a written incident response plan outlining how to address cybersecurity events that occur. The plan sets forth the steps for coordination among various corporate functions and governance groups, including the legal and finance functions, the Board, and external breach counsel, and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to our cybersecurity incident response plan, we conduct tabletop exercises to enhance our incident response preparedness. We maintain business continuity and disaster recovery plans for certain critical applications and services to prepare for and respond to the potential for a disruption in the technology we rely on.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Although, we and our third-party service providers have experienced cybersecurity incidents, which have resulted in adverse impacts to our business, we have not experienced material losses or other material consequences related to cybersecurity incidents experienced by us or our third-party service providers. However, we expect to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the continuously evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third-party service providers, will not have a material adverse effect on our business, results of operations and financial condition. Further discussion of how TMCC's business, results of operations and financial condition may be materially adversely affected by risk from cybersecurity threats is contained in Item 1A. Risk Factors, Regulatory, Legal and Other Risks, "A security breach or a cyber-attack could adversely affect our business, results of operations and financial condition."

companyName: TOYOTA MOTOR CREDIT CORP


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures;

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Cybersecurity and data protection is essential for the Company to maintain the trust of our customers, team members and stakeholders. The Board of Directors is ultimately responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Included in our Information Security Policy is a documented incident response plan to identify, assess, manage and mitigate cybersecurity incidents. As part of our risk management program, we maintain a technology management security team, led by our Information Security Officer (ISO). Among their responsibilities, our technology management security team is responsible for conducting due diligence on software, hardware or services vendors where access to systems or data of Forrester or our clients is contemplated. The security team assesses whether these vendors have appropriate privacy and security controls and whether there are adequate contractual protections in place. We also engage external security assessment vendors from time to time to conduct penetration testing and vulnerability assessments and to report findings to management.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Cybersecurity risk management is overseen both as a critical component of our overall Enterprise Risk Management program and as a standalone program. We have implemented a risk-based, multilayered approach to assessing, identifying, and managing cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.

companyName: MCCORMICK & CO INC

ticker: MKC


text: In 2024, we conducted two tabletop exercises, simulating cybersecurity events and appropriate responses, with the senior leadership team of FTI including an executive officer and an outside director. We intend to continue to conduct such simulation training with this group on a periodic basis. Other directors and officers of the Company have been and will continue to be given the opportunity to participate in such training. In addition, our outside directors are encouraged to attend continuing education relating to cybersecurity.

companyName: FTI CONSULTING, INC

ticker: FCN


text: When a cybersecurity incident occurs, whether detected internally or from a third party, we evaluate the incident for criticality and potential materiality and disclosure. We consider various factors in assessing the materiality of a cybersecurity incident, including the potential for misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and business operation disruption, and may consult with external advisors, experts or legal counsel in connection with our assessment. We have escalation procedures to notify members of our executive management, Board of Directors and regulators in a timely manner based on the criticality and materiality of any cybersecurity incident.

companyName: Finwise Bancorp

ticker: FINW


text: Selected Management and Director Qualifications The HIS and CIO have both served in various roles in information technology and information security for many years, including serving in similar roles at other publicly traded companies. The HIS holds several industry accreditations, including being a certified Chief Information Security Officer, and has worked in the information technology field for over 25 years, specializing in Information Security for the last 15 years. The CIO has undergraduate and graduate degrees in technical fields, plus a master's degree in business administration, and has worked in healthcare information technology for over 20 years. Our CEO, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at Vir and at similarly situated companies, including risks arising from cybersecurity threats. For example, our CFO has been responsible for leading and managing Information Technology departments at three separate publicly traded companies, including our Company, and has leadership experience in business continuity planning in various roles. Additionally, one of our directors formerly served as the United States Secretary of Homeland Security, in which capacity she had ultimate responsibility for the cybersecurity of the critical infrastructure of the United States of America, and as President of the University of California with responsibility for cybersecurity matters related to the university's various networks.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity oversight and assessment. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: System1, Inc.

ticker: SST


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Stride, Inc.

ticker: LRN


text: Our management team, including our President and Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our management team's experience includes decades of experience in overseeing operations, including information technology functions, in the public company environment.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. Responsibility for risk oversight and management generally lies with the Company's Board. To manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company's Audit and Finance Committee. The Company's Chief Information Security Officer ("CISO") and the Information Security team provide reports to either the Audit and Finance Committee or the Board on a quarterly basis on various matters, such as current and emerging cybersecurity risks to the Company, risks and incidents that were escalated to management during the prior quarter (including those that did not require immediate escalation to the Audit and Finance Committee and/or full Board), internal and external assessments of the Company's information security program, and a roadmap of projects and major initiatives to manage its information security posture. Abercrombie & Fitch Co.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: • The Information Security function consists of qualified professionals in cybersecurity. This team sets the cybersecurity strategy for Teradata; develops Teradata's cybersecurity architecture and deploys and manages tools and technologies aligned with such architecture to safeguard our information systems; manages the cybersecurity training required of our employees; monitors our cybersecurity threats and incidents; escalates the occurrence of cybersecurity incidents pursuant to the CIRP; and addresses and incorporates mitigation items. • The CISO appoints a Cybersecurity Incident Response Coordinator ("CIRC") to lead the management of cybersecurity incidents. The primary responsibilities of the CIRC include, but are not limited to: receiving and tracking all reported potential cybersecurity threats; escalating incident response;

companyName: TERADATA CORP /DE/

ticker: TDC


text: We have specific processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. These processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. The processes are updated as needed on an annual basis.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our IT infrastructure. We have implemented various control processes designed to address cybersecurity threat risks associated with our use of such third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel. In addition, cybersecurity risks and posture are, as appropriate and applicable, a factor considered in the selection process prior to our engagement of third-party service providers.

companyName: CervoMed Inc.

ticker: CRVO


text: Depending on the relevant information systems environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, physical security, asset management (such as tracking and disposal of our information systems), systems monitoring, a vendor risk management program, personnel training, and cybersecurity insurance.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: We do not presently have any general processes for assessing, identifying, and managing material risks from cybersecurity threats. As we expand our business operations, we plan to develop processes that will allow for the identification and assessment of cybersecurity risk that will be integrated into an overall risk management system, which will be managed by senior management and overseen by the Board of Directors. As part of this development, we plan to identify and address cybersecurity risks related to our business, privacy and compliance issues through a multi-faceted approach that is expected to include third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with these planned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things, will consider: conducting proactive privacy and cybersecurity reviews of systems and applications, audits of applicable data policies, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security, and implementing appropriate changes.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Executive Vice President and General Counsel, Senior Vice President – Strategic Development and Investor Relations, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.

companyName: Nine Energy Service, Inc.


text: We, like any technology company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.

companyName: eHealth, Inc.

ticker: EHTH


text: Our Senior Vice President of Administration who reports directly to the Chief Executive Officer and has over seven years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in "PART I, ITEM 1A, RISK FACTORS," under the heading "If we experience a significant disruption in our information technology systems or breaches of data security, our business could be adversely affected."

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: Albemarle Corporation and Subsidiaries In the event of, or the reasonably likely threat of, a cybersecurity incident, our cyber response procedures outline the tasks and timeline for the escalation of the incident to key members of the organization, including the information technology team, business unit management, and Albemarle executives and other key management. These individuals would participate in a special event management plan activation meeting to gain an understanding as to how the incident was detected and analysis of the incident. Each member of management involved would be responsible for assessing the risks, impact, and necessary response as determined by their role. The procedures include key considerations each manager should consider in their assessment as well as their responsibility for involvement in remediation efforts and post-incident strategic reviews. Specific legal and executive role procedures include the assessment of necessary internal communication and external reporting. The Chief Executive Officer, with the support of other executive officers, is responsible for approval of incident reporting and informing and updating the Board of Directors.

companyName: ALBEMARLE CORP

ticker: ALB


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other various sources including external consultants engaged by us.

companyName: AMERICAN AIRLINES, INC.


text: In the event of a cybersecurity incident, we engage our Incident Response Plan, which outlines the steps to be followed regarding preparation, detection, analysis, containment, eradication, recovery, notification, and post-incident remediation. Notification includes informing functional areas (e.g., legal), as well as senior management and the Board, as appropriate. We also have an insider threat detection program to proactively identify internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement to adequately safeguard controlled unclassified information and reporting cybersecurity incidents to the Department of Defense's Cybersecurity Maturity Model Certification program. Moog also shares and receives threat intelligence information with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.

companyName: MOOG INC.

ticker: MOG-A


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our information technology team and a third-party security firm.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Our Board oversees the implementation of our cybersecurity risk management program. The executive management team provides updates to the Board, as needed, on significant cybersecurity incidents. Our Board receives periodic reports from management on cybersecurity risks and the cybersecurity risk management program.

companyName: Hour Loop, Inc

ticker: HOUR


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has information security and risk management policies and procedures designed to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of incidents in a timely manner. • Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. Additionally, the Company leverages an industry standard Endpoint Detection and Response (EDR) tool to manage and monitor endpoint security for laptops and servers including scanning and monitoring of vulnerabilities. Further, the Company has mandated multi-factor authentication for all employees in addition to periodic security and phishing training and awareness.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: Our global cybersecurity and privacy program is managed by our Chief Information Security Officer ("CISO"), Vice-President of Global IT Security, Global Chief Privacy Officer ("CPO"), and Chief Information Officer ("CIO"). We have also established a Cybersecurity and Privacy Council, which is comprised of our senior management team, including our CEO. The Cybersecurity and Privacy Council meets on a quarterly basis with the CISO, CPO and CIO to keep our CFO, General Counsel and other executive leadership informed of cybersecurity activities and new risks and requirements. The objective of this council is to review, discuss, and manage cybersecurity and privacy risks and threats, prioritize risks, monitor risk mitigation progress, advise and update on the evolving legal landscape, as well as provide visibility into ongoing activities and programs.

companyName: CRAWFORD & CO

ticker: CRD-A


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Third-Party Consultants and Auditors GoDaddy maintains industry certifications for some of the services we provide, including certifications relating to our GoDaddy Registrar, Registry, Domains, and Commerce businesses. We use third-party auditors and consultants in connection with obtaining and maintaining our certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.

companyName: GoDaddy Inc.

ticker: GDDY


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factors under the heading "Risks Related to Data Privacy and Cybersecurity" in Part I, Item 1A of this Report for additional information about the risks we face associated with cybersecurity threats.

companyName: GUESS INC

ticker: GES