text: We integrate our assessment and management of material risks from cybersecurity threats into our overall risk management processes. For example, our management security committee generally meets on a monthly basis and evaluates material risks from cybersecurity threats against our overall business objectives. Our management generally provides reports and status updates to our board of directors on a quarterly basis, as the board monitors our overall enterprise risk. In addition to our internal resources, we also use third-party service providers, including application providers and hosting companies, distributors, and supply chain resources. We have an IT vendor management program designed to identify and manage cybersecurity risks associated with our use of these providers. As part of this program, we typically conduct risk assessments for certain IT vendors on an annual basis, including, for example, using security assessment measures such as a security questionnaire, perform a review of the vendor's own security program, audits, and vulnerability scans. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and may impose contractual obligations related to cybersecurity on the provider.

companyName: Iridium Communications Inc.

ticker: IRDM


text: The Audit Committee of Berkshire's Board of Directors has responsibility for oversight of Berkshire's cybersecurity risk management program. The Audit Committee receives periodic reports regarding the number of and impact from cybersecurity incidents reported through Berkshire's cybersecurity incident reporting process. Additionally, the Audit Committee is updated on cybersecurity trends and related issues. Furthermore, the Audit Committee approves and receives updates on the workplan performed by Berkshire's internal audit group that focuses on information technology and cybersecurity risks. This includes audit procedures related to internal and external penetration testing, attack simulations, vulnerability assessments, cybersecurity program reviews and other audits designed to investigate specific risks. The frequency of these updates is determined by the Audit Committee in conjunction with Berkshire's senior management. In addition to the Audit Committee's oversight, the senior management of Berkshire's Businesses Groups are responsible for the day-to-day operations of protecting their businesses' information systems. Each Business Group is required to report significant cybersecurity events to Berkshire. Berkshire's senior management reviews incident reports to determine whether a cyber incident report should be filed with the SEC.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B

secItem: Item 1C


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems in an effort to identify areas for continued focus, improvement and/or compliance under various applicable regulatory frameworks (e.g., SOC, SOX, PCI, HIPAA).

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our cybersecurity framework is built around a comprehensive strategy that includes ongoing risk assessment, threat detection, swift incident response, and continuous improvement of our cybersecurity defenses. Key elements of our program include:

companyName: QHSLab, Inc.

ticker: USAQ


text: Infinera has comprehensive and integrated enterprise risk management and cybersecurity risk management programs that use structured, proactive, and continuous processes to identify, understand, assess, mitigate, and report on enterprise and cybersecurity risks in alignment with business objectives. Our risk management program is used to guide and strengthen our cybersecurity posture to engender trust with customers, employees, and stockholders and to help protect the confidentiality, integrity, and availability of our systems and data.

companyName: Infinera Corp


text: Our Chief Information Officer is responsible for timely informing management regarding cybersecurity incidents, including prevention, detection, mitigation, and remediation activities. Our Chief Information Officer and Director of Cybersecurity communicate at least annually with the Board on matters such as data protection and cybersecurity. We maintain cybersecurity incident response plans, which address defined actions to be taken in response to cyber incidents. In the event of a material cybersecurity incident, the Chief Information Officer must notify both management and the Board.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: We engage qualified third-party cybersecurity experts for in-depth cyber risk assessments, penetration tests, and compliance audits, which provide impartial perspective and insight into our cybersecurity posture and we engage consultants for the development and refinement of our cybersecurity strategy and maturity, drawing upon industry best practices and regulatory knowledge. These collaborations also include the refinement of our incident response and crisis management plan and employee training, emphasizing the transfer of knowledge for sustainable in-house capabilities.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Because we are aware of the risks associated with third-party service providers, we also have implemented processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.

companyName: Childrens Place, Inc.

ticker: PLCE


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under the heading "Actual or attempted security incidents or breaches, loss of data, or other disruptions could expose us to material liability and materially and adversely affect our business, financial condition, and our reputation," which disclosures are incorporated by reference herein.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors, consultants and auditors to evaluate and test our systems and to advise us on cybersecurity risk management processes. These relationships enable us to leverage specialized knowledge and insights, in an effort to keep our cybersecurity strategies and processes at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: ZimVie Inc.


text: Our CISO is a Certified Information System Security Professional (CISSP) with decades of experience with technology in security, architecture, infrastructure and support in the financial, education, healthcare and verticals. He is a results driven leader who has managed multimillion dollar projects and solutions to successful completion. Our CTO has over 25 years of experience in enterprise technology services with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.

companyName: NewtekOne, Inc.

ticker: NEWT


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.

companyName: Smart Sand, Inc.

ticker: SND


text: JFG maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. This process includes reviewing risks discerned from time to time from both internal events and from external events, alerts and reports received from a broad variety of sources. Reports from external sources are also reviewed to formulate risk mitigation and remediation strategies. JFG's CISO periodically discusses and reviews cybersecurity risks and related mitigants with JFG's Chief Information Officer ("CIO"), the Head of IT Risk, and General Counsel and incorporates relevant cybersecurity risk updates and metrics. JFG adjusts and enhances its cybersecurity program in response to the evolving cybersecurity landscape and to align with regulatory and industry standards.

companyName: Senior Credit Investments, LLC


text: Our Vice President, Information Technology & Facilities, who reports directly to the Chief Operating Officer and has over 15 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not experienced any cybersecurity incidents that resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents See "Risk Factors" for additional information on cybersecurity risks we face.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: See "Risk Factors— Technology failures or cybersecurity breaches or other unauthorized access to or use of our information technology systems or sensitive or proprietary information could have a material adverse effect on the Company's business and operations."

companyName: Karman Holdings Inc.

ticker: KRMN


text: Our cybersecurity strategy includes policies, procedures, and technology that proactively safeguard our operations against cybersecurity threats. Internal teams and external experts regularly conduct risk assessments and audits to identify cybersecurity threats, ensure regulatory compliance, and adhere to control process best practices. Continuous monitoring of our networks and systems for threats and vulnerabilities is a key component of our strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats. We regularly review and update our cybersecurity strategies, policies and procedures, taking into consideration the latest advancements in cybersecurity practices and changes to the threat landscape.


text: The Board, in coordination with the Audit Committee, oversees the Company's risk management and information technology programs, including the management of cybersecurity threats. The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company's peers and third parties. The Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company's approach to overseeing cybersecurity threats with the Company's head of Information Technology and other members of senior management.

companyName: Xencor Inc

ticker: XNCR


text: As one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the NIST Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate IT systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: The Company relies on third-party service providers for a variety of products and services to run its information systems. Our Company's Chief Information Officer and Chief Information Security Officer are provided to us by a third-party service provider. This dependence exposes us, along with others who use these service providers, to the impact of a cyber-attack on their service providers. It is possible for a cyber-attack at a third-party service provider to have a significant financial, operational, or reputational impact to the Company. To reduce the effective impact to the Company of a cyber-attack on a third-party service provider, we continuously monitor the risks associated with our service providers through review of these providers' cybersecurity programs annually and when material changes to their programs occur.

companyName: Everything Blockchain, Inc.

ticker: EBZT


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If we or our third-party providers fail to protect our IT Systems or Confidential Information, and/or experience a data security incident our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences."

companyName: Fastly, Inc.

ticker: FSLY


text: Those responsible for assessing and managing FHLBank's material risks from cybersecurity threats have expertise and experience relevant to their roles. FHLBank's CIO has served in technology and leadership roles for over 30 years, including almost 27 years of experience with FHLBank. During the last 14 years, the CIO has provided oversight and strategic direction for the Information Security area of the Information Technology department, including cybersecurity risk management, cybersecurity governance, and incident response. The ISO has more than 25 years of information technology experience, including 24 in the financial industry, and 22 years of experience managing information security. The ISO has a Bachelor of Science degree in Computer Science Information Systems. The Director of Information Security is a retired United States Air Force Lt. Colonel whose primary career focus was in intelligence analysis. The Director of Information Security also has 14 years of experience building and leading cybersecurity programs, including cyber threat intelligence programs and cyber regulatory compliance; 16 years of cyber intelligence analysis experience, including military and civilian; five years of continuity of operations and business continuity program development; and holds a Master of Arts degree in Strategic Intelligence Studies and is a Certified Information System Security Professional.

companyName: Federal Home Loan Bank of Topeka


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and senior vice president investor relations and corporate communications. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: The Company additionally performs annual tabletop exercises with the information technology team pertaining to infrastructure and cyber security related events, to test the Company's incident response and business continuity plans in the event of a cybersecurity incident.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: The Audit Committee of the Board of Directors oversees our cybersecurity and risk management programs, and receives updates from our Information Security and Compliance teams regarding the effectiveness of these programs on a quarterly basis. These reports include descriptions of security incidents and observed trends in threat activity, new programs and tooling designed to address developing areas of risk, and performance reporting of third-party testing, including security awareness training and cybersecurity assessments. The full Board of Directors has general oversight of the Company's risk management programs, which include cybersecurity risks, and the Audit Committee provides regular reports to the full Board of Directors related to cybersecurity matters and related risk oversight.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: As of the date hereof, we have not identified any cybersecurity threats or previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Part I. Item 1A. Risk Factors."

companyName: HUNTSMAN INTERNATIONAL LLC


text: TMTG has also implemented controls designed to identify and mitigate cybersecurity risk associated with our use of third-party service providers.

companyName: Trump Media & Technology Group Corp.

ticker: DJT


text: Our Chief Financial Officer and head of IT, advised by external cybersecurity consultants, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our head of IT has over 25 years of experience in information technology roles and over 8 years of experience in security roles in the biotechnology industry. Our Chief Financial Officer has approximately 7 years of experience overseeing IT-related processes (including cybersecurity processes).

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We regularly engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: CEVA INC

ticker: CEVA


text: Our Chief Information Security Officer (CISO) leads our global cybersecurity program and is responsible for management of our cybersecurity risks. Our CISO reports to our CFO. Our CISO has served in that position since 2022 and has relevant experience in cybersecurity leadership positions, including prior experience as CISO of a public company. The Audit Committee regularly reviews our risk exposures relating to cybersecurity with our CISO and CFO, including review of the state of the Company's cybersecurity and emerging cybersecurity developments and threats and the steps management has taken to monitor and mitigate such exposures. Our CISO manages a team of cybersecurity professionals with expertise and experience in information security.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats (including any previous cybersecurity incidents) that could be reasonably likely to materially affect us, please refer to our Risk Factors discussion under the heading 'We may be subject to disruptions, breaches or cyber-attacks of our secured networks and information technology systems that could damage our reputation, harm our business, expose us to liability and materially adversely affect our results of operations' in Item 1A of this Annual Report on Form 10-K.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with potentially material risks. Cybersecurity is a key risk management category within our enterprise risk management program.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Projects, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Although we experience cybersecurity incidents from time to time as part of operations, these incidents have not had, and are not reasonably likely to have, a material impact on our business strategy, results of operations or financial condition. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risk Factors" on page 13 of this Form 10-K for further discussion of the risks related to cybersecurity threats.

companyName: FARO TECHNOLOGIES INC


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: ATN International, Inc.

ticker: ATNI


text: Our management team provides periodic updates to the audit committee regarding our cybersecurity program, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company.

companyName: Climb Bio, Inc.

ticker: CLYM


text: As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: HCW Biologics Inc.

ticker: HCWB


text: We use third party vendors to perform ongoing security monitoring, reporting and forensic analysis, as necessary including annual external penetration testing. Security standards are established and defined with respect to administrator accounts, backups, encryption, passwords, website certifications, antivirus software, endpoint management, firewalls, wi-fi networks, vulnerability scanning, server protection, patching, privacy by design, and data breach reporting. We perform ongoing employee cybersecurity awareness and training activities, which includes frequent phishing testing, and we maintain cyber insurance to provide coverage in the event a material cybersecurity incident arises.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Information Security Officer, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers. We conduct regular employee training on cybersecurity and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including anticipated future threats and trends, and their estimated impact on the Company's risk environment.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: During Fiscal year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: IGC Pharma, Inc.

ticker: IGC


text: We utilize a combination of manual processes, specialized software and automated tools, and third-party assessments to assist with our cybersecurity efforts. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: HeartSciences Inc.

ticker: HSCS


text: Risks from Third Party Service Providers and Others. Manhattan's cybersecurity team, under the oversight of the Senior Director, Global Security, performs risk assessments on third party service providers and other third parties (such as partner companies), as well as third party software and hardware utilized in its operations, that may have the potential to create cybersecurity threats to our data and operations.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: We further monitor, test, assess, and update these processes, including working with technology partners, government agencies, regulators, law enforcement, industry groups, and peers to implement practices to guard against an evolving cyber threat environment and to ensure we remain compliant with relevant regulatory requirements. We offer cybersecurity training for corporate employees at headquarters and terminal locations, focusing on reducing human risk through anti-phishing and social engineering exercises. We also carry cybersecurity insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: The Bank has also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of the Bank's critical third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and based on risk profile. A variety of inputs are used in such assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. In addition to being subject to routine examination by the Bank's state and federal regulators, the efficacy of the Bank's information security program is also audited annually by an independent third-party auditing firm.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical corporate computer networks, third party hosted services and production computing environment utilized to provide our services, and our critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer-related data ("Information Systems and Data").

companyName: CS Disco, Inc.

ticker: LAW


text: The Audit Committee is responsible for reviewing the adequacy and effectiveness of the Company's information security policies, the internal controls regarding information security and cybersecurity, and risks related to such exposures and actions taken to monitor and/or mitigate such risks. The Audit Committee receives quarterly reports as part of its meeting materials prepared by our CISO regarding the assessment of the status, adequacy, and effectiveness of our processes related to assessing, identifying, and managing cybersecurity risks and related mitigation plans. In addition, at least twice per year, the Audit Committee meeting agenda includes a presentation by the CISO to review and discuss the CISO's report on cybersecurity risks, mitigation plans and the steps the security team has taken to monitor and control related exposures. The Audit Committee reports to the Board on cybersecurity matters discussed at its meetings and the CISO's quarterly reports are provided to the Board as part of their meeting materials for their information as well.

companyName: TERADATA CORP /DE/

ticker: TDC


text: The Board of Directors has responsibility for oversight and approval of our cybersecurity risk management processes, and the Board has established an oversight mechanism for cybersecurity risks.

companyName: MEDIFAST INC

ticker: MED


text: As part of our overall risk management system, our CEO will monitor and test our safeguards in collaboration with outside IT consultants.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: Cyber Risk Management & Strategy As part of its overall risk management system, the Company utilizes a third party to help assess the Company's processes and practices for managing and mitigating cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: In the event of a potential cybersecurity incident, the AIMC will conduct an assessment to determine the nature and scope of the incident and manages the incident in accordance with our incident response plan until the incident is contained and resolved. The AIMC will document findings and make them available to the Disclosure Committee, which includes cross functional senior management representation from, legal, finance, investor relations and business segments. The Disclosure Committee, in conjunction with third-party experts, including outside legal counsel, is responsible for assessing the materiality of any cybersecurity incident and coordinating external communications and disclosures, including with the Securities and Exchange Commission.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: To address significant cybersecurity incidents and other crisis events, we maintain a business incident response plan, which identifies key stakeholders, defines escalation processes, and sets the thresholds above which our cybersecurity, legal, and crisis management teams will inform management's Executive and Disclosure Committees as well as when the CEO and his designee will inform the board of directors of an incident. For cybersecurity incidents below these crisis thresholds, we maintain subordinate incident response plans and standard operating procedures used by our security incident response team. Like many companies, we, and some third parties on which we rely periodically experience cybersecurity incidents. However, as of September 30, 2024, we were not aware of any direct or third-party cybersecurity incidents in the past three fiscal years that have materially affected our business strategy, results of operations, or financial condition.

companyName: VISA INC.

ticker: V


text: Our Board, directly or through its committees, is responsible for the oversight of the Company's overall enterprise risk management program, which includes cybersecurity risks. Our Audit Committee regularly reviews and evaluates cybersecurity risks and the procedures and policies implemented by management to identify, manage, and mitigate such risks.

companyName: ICF International, Inc.

ticker: ICFI


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: We have developed, implemented, and integrated a cybersecurity program, or the Cybersecurity Program, into our broader risk management structure to protect our information systems by using physical, technical, and administrative safeguards. This includes assessing, identifying, monitoring, reporting, managing and remediating cybersecurity threats. The Cybersecurity Program aims to prevent data ex-filtration, manipulation, and destruction, as well as system and transactional disruption. The Cybersecurity Program utilizes a threat-centric and risk-based approach to identify and assess cybersecurity threats that could affect our business and information systems based on the National Institute of Standards and Technology Cybersecurity Framework, or the NIST Framework.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: We use various mechanisms to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually. We also conduct tabletop exercises to simulate responses to cybersecurity incidents. During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Product Officer, Chief Operating Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats. The executive leadership team regularly discusses security threat trends; incident trends, including any significant incidents that may arise; risk mitigation; and overall security strategy as part of our enterprise security governance process. We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises our independent public accounting firm of any relevant developments.

companyName: COMSCORE, INC.

ticker: SCOR


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and response systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.

companyName: LANDS' END, INC.

ticker: LE


text: A cross-functional incident response team, comprised of representatives from information security, information technology, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.

companyName: SentinelOne, Inc.

ticker: S


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management (ERM) approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology. We approach cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to us; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect our intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: The Audit Committee of the Board has responsibility to oversee management's strategy to address risks from cybersecurity threats. The Audit Committee periodically reviews with management the Company's policies, controls, and procedures used to identify, mitigate, and manage cybersecurity risks. To accomplish this objective, we have established processes for reporting cybersecurity risks to the Audit Committee of the Board on a quarterly basis. This report, which is prepared by our Senior Vice President and Chief Technology Officer, includes performance as against key performance indicators (KPIs) and service level objectives specifically defined to measure the effectiveness of our cybersecurity controls and risk management efforts, current threat landscape, and strategy. In addition, on at least an annual basis the Company's Senior Vice President and Chief Technology Officer presents to the Audit Committee on cybersecurity matters, including material changes to the Company's information systems, policies and controls, the results of penetration and other testing and findings from any third-party reviews. Our Audit Committee is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy to address risks from cybersecurity threats and the evolving threat landscape. The Board also is apprised of cybersecurity risks as part of its review of management's annual enterprise risk management assessment.

companyName: AGNC Investment Corp.

ticker: AGNC


text: The CTO and the Cybersecurity Management Board monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of the Company's incident response plans, which include escalation to the CTO and the Cybersecurity Management Board, as appropriate. As discussed above, the CTO reports out to the Risk and Cybersecurity Committee about cybersecurity threat risks, among other cybersecurity related matters, at least quarterly.

companyName: Usio, Inc.

ticker: USIO


text: However, it is difficult or impossible to defend against every risk being posed by evolving technologies as well as criminal intent on committing cyber-crime. Increasing sophistication of criminal organizations and advanced persistent threats makes staying ahead of new dangers difficult and could result in a security breach. Controls employed by our information technology department and cloud vendors could prove inadequate. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have an adverse effect on our business, financial condition, and results of operations. The Company has established conditions to quickly respond to a cyber incident, ensuring a resilient, information environment.

companyName: Merchants Bancorp

ticker: MBIN


text: Conducting an annual self-assessment using the Cyber Risk Institute (based on the NIST Cybersecurity Framework) to review our cyber risk-management strategy and framework, assess the effectiveness and legal and regulatory compliance of our organizational cybersecurity policy, and evaluate our policies and procedures for identifying risks, protecting information, detecting security threats, responding to cyber incidents, executing recovery plans, and managing levels of external dependence and resiliency;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Employees play a significant role in the defense against cybersecurity threats. Every employee is responsible for protecting the Bank and client information. Accordingly, employees complete formal training and acknowledge security policies annually. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Risk Management and Strategy Atlanta Braves Holdings' corporate level information technology ("IT") and cybersecurity functions are provided by Liberty as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate level, as detailed below. Braves Holdings operates its own cybersecurity function with oversight from Atlanta Braves Holdings.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: LNC's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with LNC's Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. LNC also has a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and LNC's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for cybersecurity. Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The team includes senior professionals, many with more than 15 years of cybersecurity expertise and industry certifications such as Certified Information Security Systems Professional, CompTIA Security+, Global Information Assurance Certification, and Certified Ethical Hacker. Members of the team are provided with opportunities to attend external training, conferences, and other events to keep abreast of the latest cybersecurity trends. Our CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: FLUOR CORP

ticker: FLR


text: We monitor industry trends to prioritize and mitigate cybersecurity risk for our customers, associates and business, and to remain apprised of industry developments and emerging threats. CarMax engages in testing to improve our cybersecurity approach internally and with third-party vendors and conducts exercises based on current threat intelligence. Additionally, all CarMax associates are required to complete the company's cybersecurity training program on an annual basis.

companyName: CARMAX INC

ticker: KMX


text: In Fiscal 2025, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.

companyName: OPEN TEXT CORP

ticker: OTEX


text: o Training and Awareness: Members of management and members of our board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. Management reviews Company employee training programs to ensure employees are being trained appropriately and kept up to date on evolving cyber trends.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We have no employees and are externally managed by our Advisor, an affiliate of our Sponsor. Our Advisor has responsibility for our day-to-day operations, serving as a consultant in connection with policy decisions to be made by the board of directors.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: Our CISO is responsible for our overall information security strategy, policy, security engineering, operations, cybersecurity threat detection and response. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. Cybersecurity team members provide regular reports to our CISO with respect to the prevention, detection, mitigation and remediation of cybersecurity incidents, and otherwise aid our CISO in operating the ISMS. Cybersecurity team members have relevant education, certifications, and industry experience.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Use of cybersecurity consultants and managed security services providers to supplement the security program practices and evaluate the program's effectiveness, specifically: Governance, risk, and compliance services. Penetration testing and vulnerability management. Continuous security event monitoring. Data loss prevention.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Ongoing Evaluation and Assessment of Systems and Procedure : We monitor compliance with regulatory, industry and evolving data privacy requirements and update our cybersecurity risk management program from time to time as appropriate. We also continuously monitor our information security systems and processes on an ongoing basis to identify and remediate cybersecurity threats and vulnerabilities that could be exploited to adversely impact our business operations. To better preemptively identify risks and vulnerabilities in our security systems, we perform penetration testing for security controls using external third-party tools and encourage vulnerability reporting within our organization,

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology, or NIST Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Aspects of the Information Security program are audited by the Company's Internal Audit provider(s) to ensure aspects are aligned with regulatory expectations.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: Industry Standards and Benchmarks Our cybersecurity program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Additionally, periodic tabletop exercises simulate real-world scenarios to test our readiness and improve our incident response capabilities.

companyName: Astrana Health, Inc.

ticker: ASTH


text: The Company has several processes in place to oversee and identify these risks, such as the Information Technology Risk Governance Committee ("ITRGC"), which is responsible for oversight of information technology ("IT") and information security ("IS") risk. This committee oversees the establishment and revision of IT and IS key risk and key performance indicators and ongoing monitoring of these metrics. The Company's Chief Information Security Officer ("CISO") is responsible for cybersecurity initiatives at the Company, including identifying and managing security risks, and escalating elevated risks with the Chief Risk Officer ("CRO") where applicable. Together, the CISO and the CRO report on emerging and existing threats and mitigation strategies to the Board, which has oversight of cybersecurity risk, on a semi-annual basis, or more frequently, if needed. The CISO has over 30 years of information security experience, with experienced team members that come from a wide range of industries and possess substantial knowledge and expertise in how to manage information security and cybersecurity risks. Additionally, the team of employees supporting the CISO maintain education and certification requirements necessary to fulfill their responsibilities.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our digital transformation team under the supervision of the Chief Financial Officer and Chief Executive Officer of the Company, both of whom have experience in business operations including risk management and oversight of information technology functions within the biopharmaceutical industry. Our digital transformation team includes members with relevant expertise in cybersecurity, incident response, and the safeguarding of company assets. The digital transformation team undertakes efforts to learn about the Company's cybersecurity threats by reviewing security assessments and other security-related reports.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: We maintain enterprise-wide policies and procedures for reporting and managing security incidents, including prompt reporting of all incidents. We perform incident response simulations on at least an annual basis.

companyName: Vynleads, Inc.

ticker: VYND


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Advisor and other third-party service providers. The Advisor manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Kennedy Lewis Capital Co


text: Our Incident Response Policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Senior Vice President of Finance and Financial Planning. Our Senior Vice President of Finance and Financial Planning and, if escalated, other senior management, work with our incident response team to help mitigate and remediate cybersecurity incidents. In addition, our Incident Response Policy includes reporting to the Audit Committee for certain cybersecurity incidents. The Incident Response Policy is managed and maintained by our Director of Information Technology, with oversight from our Senior Vice President of Finance and Financial Planning. The Audit Committee receives periodic updates from our Senior Vice President of Finance and Financial Planning regarding the status of our cybersecurity program and our posture to identify and mitigate risks to our information security.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: The Bank leverages audits and external reviews to strengthen its program. Those reviews include internal audits and reviews by the Bank's Risk Management function, SOX audits, penetration tests, and external benchmarking reviews based on the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization ("ISO") standards. Those reviews assist the Bank in assessing, identifying, and managing cybersecurity incident and threat risk.

companyName: Federal Home Loan Bank of New York


text: The Company's cybersecurity risk management and strategy are regularly reviewed and updated to support our business strategy and objectives, our overall risk management, and address evolving potential cybersecurity threats.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Our ERM program is overseen by a group of highly-qualified individuals and is tailored to the unique structure of our business. As a holding company with a small group of highly qualified employees, we are well positioned to maintain operations in the event of a disaster or a material disruption to our information technology ("IT") infrastructure and networks. Our CISO has extensive information technology, cybersecurity and program management experience as do many of the employees in the information security group for our third-party provider. Our CISO, as well as others in our third-party provider's information security group, hold certifications such as the Certified Information System Security Professional certification. Each of our various businesses separately maintains business continuity functions that adhere to the unique requirements of their business.

companyName: Cannae Holdings, Inc.

ticker: CNNE


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations, and reputation. Although our cybersecurity risk management processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Our internal computer systems, or those of our customers, collaborators or other contractors, have been and may in the future be subject to cyber-attacks or security breaches, which could result in a material disruption of our product development programs or otherwise adversely affect our business, financial condition, results of operations, cash flows and prospects" within Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: Currently, our sole director does not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: We conduct periodic internal and external vulnerability audits and assessments and penetration testing and provide periodic cybersecurity training to employees. These measures include regular phishing simulations, annual general cybersecurity awareness training and data protection training. We also participate in industry-specific cybersecurity roundtables and professional groups to ensure we remain abreast of industry-wide cybersecurity developments and best practices and thereby enhance our threat identification processes and responses as necessary. Additionally, when engaging with and utilizing third-party vendors and partners for our business, we conduct various oversight assessments, including due diligence and periodic monitoring to identify potential cybersecurity threats associated with our conducting business with such vendors and partners and to ensure any corresponding risk exposure aligns with our business requirements and risk tolerances.

companyName: BGC Group, Inc.

ticker: BGC


text: Notwithstanding the extensive approach we take to cybersecurity, Wintrust continues to face risks and accompanying threats that could have a material adverse effect on the enterprise. We work to manage these risks and threats on a daily basis. To date, we have not realized any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are reasonably likely to, materially affect us, our business strategy, results of operation or financial condition. We continue to invest in our cybersecurity program, the resiliency of our networks and work to enhance our internal controls.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC


text: Under the management and direction of the Chief Information Officer, the CISO is responsible for assessing and managing our material risks from cybersecurity threats. The CISO also has a dotted line reporting relationship to the CRO for purposes of informing the CRO on related risks. The cybersecurity risk management function under the CRO is responsible for identifying, assessing and evaluating cybersecurity risks and monitoring and tracking cybersecurity risk mitigation strategies.

companyName: Federal Home Loan Bank of Indianapolis


text: The Company's management maintains and implements a written Incident Response Plan, which is reviewed and updated on an annual basis and includes an Incident Response Plan Executive Committee consisting of the Company's CIO, CISO, and General Counsel. In addition, members of the CISO's and CIO's teams monitor the Company's systems and processes and promptly report incidents as required under the Incident Response Plan, including, but not limited to, reporting to the appropriate members of management and, as needed, the Audit Committee.

companyName: CARTERS INC

ticker: CRI


text: We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers. Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture are refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors. Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Cyber Insurance Coverage. The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: A cross-functional Compliance Committee comprised of O'Reilly executive and senior leadership, including our Chief Information Officer ("CIO"), have responsibility for assessing and managing material cybersecurity risks and oversees our enterprise security, privacy, and risk priorities, including ensuring alignment on security decisions across the Company. The Compliance Committee meets quarterly, or as needed, to review security performance metrics, identify security risks, assess the status of approved security enhancements, and discuss future changes necessary to execute best practice, among other items. The Compliance Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies to senior management. We have an established escalation process to help ensure senior management and the Board are timely informed of any potential cybersecurity issues or incidents. Our comprehensive monitoring, analysis, response, and communication protocols are designed to ensure the highest level of management is informed of cybersecurity risks and that the Board has comprehensive oversight and information necessary to provide guidance on critical cybersecurity issues.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Our Board of Directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO regarding cybersecurity, which updates include a review of our Manager's global security program and cybersecurity, including risks and protections for us and our Manager. The Global Operational Risk Management Committee, one of our Manager's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO serves as a member of and provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our Board of Directors, and members of our management team are included in our Manager's incident response process in the event a cyber security incident occurs that could materially impact us.

companyName: Invesco Mortgage Capital Inc.

ticker: IVR


text: Board of Directors actively collaborates with management to supervise cybersecurity risks. The Chief Technology Officer ("CTO"), with over 10 years' experience in cybersecurity, leads the Company's overall cybersecurity function and monitors cybersecurity risks. The CTO works with internal personnel and third-party consultants to design and implement the controls on the prevention, detection, mitigation, and remediation of cybersecurity risks. The CTO maintains regular communication with the Board on matters related to cybersecurity and provides updates to management on a quarterly basis. In the event of a cybersecurity incident, the Board is to be promptly notified.

companyName: Sensus Healthcare, Inc.

ticker: SRTS


text: Security procedures to protect information that is electronically stored or transmitted include authentication protocols; secure access control measures, and encryption of all transmitted files;

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: We believe that our current cybersecurity program provides adequate measures of protection against cybersecurity breaches and generally reduces our risks. However, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our senior management is responsible for the day-to-day assessment and management of our cybersecurity risks. This function is led by our Chief Executive Officer and Chief Financial Officer, who have overall responsibility for the Company's risk management. our executive officers are not cybersecurity experts, they have extensive experience in business management and corporate governance.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: We have not experienced any material cybersecurity incidents in the past, and we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in the cybersecurity and resiliency of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The Company depends on and engages various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with the Company's use of such entities.

companyName: Nuveen Global Cities REIT, Inc.


text: Regular independent third-party assessments, penetration testing, and internal audits are conducted to validate controls and to position our cybersecurity maturity level at or ahead of industry trends in meeting stringent security standards. We regularly assess our security program internally and externally, through benchmarking studies and assessments against our Information Security and Privacy Policies and Standards and conduct assessments of the effectiveness of relevant internal control activities designed to restrict inappropriate access to our IT systems, support data integrity within our IT systems, and ensure ongoing availability of our IT systems. Certain of these control activities are also subject to an assessment by our external auditor to support its opinion on the effectiveness of our internal control over financial reporting.

companyName: Jackson Financial Inc.

ticker: JXN


text: We regularly engage with third parties to assist in the testing, maintenance, and development of our cybersecurity risk management practices and to assess, identify, and manage cybersecurity incident and threat risk.

companyName: Federal Home Loan Bank of Topeka


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors 24/7 to monitor and respond to security threats. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.

companyName: EACO CORP

ticker: EACO


text: Cybersecurity risk management processes are one component of our overall risk assessment process whereby, on an ongoing basis, we analyze our internal control environment and consider how threats to the business might circumvent those controls. These processes include control over and segregation of user access to key systems, monitoring of any user access anomalies, active monitoring of emerging trends in the broader market, timely identification and quarantine of any potential cybersecurity incidents, evaluation of our operations and business needs and how executing on those needs translates to potential threats, and training of end users to mitigate the likelihood of user error.

companyName: Laird Superfood, Inc.

ticker: LSF


text: The Enterprise Risk Committee is responsible for reviewing and recommending the approval of the Information Security Policy by the Board. The Enterprise Risk Committee provides independent and integrated oversight of the Bank's Information Security program and security exceptions and violations. The Bank's Technology & Operations Committee is responsible for reviewing the Bank's security awareness and physical security procedures and implementation reports, provides guidance and monitors progress on major information security projects, and regulatory changes.

companyName: Federal Home Loan Bank of San Francisco


text: The Board of Directors oversees Management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management regularly briefs the Board of Directors on our cybersecurity and information security posture, and the Board of Directors is apprised of cybersecurity incidents at quarterly Board of Directors meetings.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: The Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: CARGO Therapeutics, Inc.


text: Reporting to the Board The Senior Vice President of Information Technology regularly informs the Chief Executive Officer and GC of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Matador Resources Co

ticker: MTDR


text: As part of our cybersecurity defense structure, our internal cybersecurity team performs the following actions, without exclusion: (i) tracking cybersecurity risks, threats and incidents to help identify and analyze them; (ii) promptly reporting significant cybersecurity risks, threats and incidents to our CIO; and (iii) utilizing third-party vendors and software for review, testing, preemption and monitoring of cybersecurity risks, threats and incidents.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: Cybersecurity Risk Strategy and Management Our cybersecurity strategy is focused on cyber-resilience, the ability to anticipate, withstand, recover from and adapt to adverse conditions, stresses, attacks or compromises on systems that use or are enabled by cyber resources. Continuous improvement actions are designed to drive to a zero-trust architecture and a cyber-resilient enterprise. While this cyber-resilience strategy is in place, our systems, and those of our customers, suppliers and other service providers, are subject to cybersecurity incidents. A system disruption could result in business disruption, theft of our intellectual property, trade secrets or customer information and unauthorized access to personnel information. The Company maintains safeguards, including training, incident response reviews, cybersecurity insurance and business continuity mechanisms to protect the Company's assets. The Company also leverages a third-party cybersecurity program with the goal of minimizing disruption to the business and production operations, strengthening supply chain resilience in response to cyber-related events. To the extent that our business is interrupted, or data is lost, destroyed or inappropriately used or disclosed, such disruptions could significantly and adversely affect our competitive position, relationships with our customers and other stakeholders, financial condition, operating results and cash flows. In addition, we may be required to incur significant costs to protect against these disruptions or security breaches in the future.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.

companyName: EchoStar CORP

ticker: SATS


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. In response to the increasing threats presented by cyber incidents, in 2023 we established a Cybersecurity Steering Committee, which meets bimonthly. This committee is comprised of our Head of IT and Security Leader, along with our Deputy General Counsel who reports to our General Counsel. The Cybersecurity Steering Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Steering Committee develops and implements cybersecurity risk mitigation strategies and activities, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, ensures policies and procedures are current and followed, and receives regular updates on cybersecurity-related matters.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, along with the emerging use of AI, could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: Ladder Capital Corp

ticker: LADR


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors (the "Audit Committee"), provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer ("CCO") regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: FS Credit Real Estate Income Trust, Inc.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: DIH HOLDING US, INC.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis but at least annually.

companyName: PHX MINERALS INC.


text: Risk Management and Strategy the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks.

companyName: Nordicus Partners Corp

ticker: NORD


text: The cybersecurity risk identification process includes: (i) identifying information systems and assets, including physical and virtual devices, software, data, data transfers, external systems, and cloud resources; (ii) reviewing organizational business processes, identities, access, and roles (including privileged access), asset configurations, technology policies, standards, controls, and processes; (iii) determining if those systems or assets process or store customer and/or employee personal data, (iv) analyzing the criticality of systems, assets and business processes and sensitivity of data; and (v) identifying vulnerabilities and threats to the identified systems, assets, data, and processes, from both internal and external sources, including through threat intelligence, previous cybersecurity incidents, and third-party assessments.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any major breaches, we actively monitor and mitigate cyber threats, including phishing attempts, malware and targeted attacks. Thus far all such incidents have been minor, isolated and promptly contained. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: In addition, we provide an employee information security training program to educate employees on various cybersecurity risks and mitigation strategies. We also maintain policies and processes governing our third-party security risks. As part of these processes, we gather information from certain third parties who contract with us and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require certain third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of certain data breaches that may impact our data.

companyName: VERINT SYSTEMS INC


text: Our management team, including our Head of Information Technology and Chief Legal Officer and Head of Operations, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 30 years of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.

companyName: Unity Biotechnology, Inc.


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors has delegated to the Audit Committee oversight over cybersecurity risk.

companyName: Cornerstone Building Brands, Inc.


text: We employ controls to continuously monitor and assess the information gathered by our security tools, services to identify gaps, exposures, or weaknesses in our overall security posture, and engage reputable external specialists to provide independent assessments of our cybersecurity program, and response preparedness. Further, the Company's enterprise level IT general controls are audited annually.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Cybersecurity threats, including the results of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Longeveron Inc.

ticker: LGVN


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and has previously served as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 490 professionals as of July 31, 2024. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skillsets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context;

companyName: INTUIT INC.

ticker: INTU


text: We have adopted as the governance framework for our cybersecurity program the Service Organization Control Type 2 (SOC2) and the Health Insurance Portability and Accountability Act (HIPAA). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business.

companyName: Cardio Diagnostics Holdings, Inc.

ticker: CDIO


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within Engineering, and overseen by Goldman Sachs' chief information officer. This program is designed to identify, assess, document, and mitigate threats, establish, and evaluate compliance with information security mandates, adopt and apply the security control framework, and prevent, detect, and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fortinet, Inc.

ticker: FTNT


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: The Audit Committee receives quarterly reports from our Chief Information Officer, or CIO, on our cybersecurity risks. In addition, our CIO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber-attack in the future could materially affect our ability to operate.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CFO, General Counsel, or GC, and Chief Executive Officer, or CEO. Our GC, CFO, and other leadership personnel work with our incident response team to help assess impact and mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit committee of our board of directors, as appropriate.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Ameren's cybersecurity program and team are led by the Chief Information Security Officer, who possesses over 25 years of critical infrastructure experience both managing and protecting information systems in concert with extensive cybersecurity operations and leadership roles. The Chief Information Security Officer regularly engages with senior-level Ameren officers, reports to the risk management steering committee, and has recurring meetings with the Cybersecurity and Digital Technology Committee as part of ongoing risk management and oversight of the cybersecurity program. In addition, Ameren's board of directors participate in periodic cybersecurity drills to prepare for potential crisis scenarios.

companyName: AMEREN CORP

ticker: AEE


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third -party vendors. We apply mitigations and processes based on our evaluation of the criticality of the vendor and the sensitivity of the data the vendor accesses. Our current vendor evaluation procedures include, as appropriate, an assessment prior to onboarding and implementation of cybersecurity-specific contract provisions. We are in the process of expanding and maturing these vendor risk management procedures.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: As part of its approach, the Company conducts varied due diligence on its key technology vendors to review their cybersecurity risk profiles and scores. This includes pre-contract award due diligence reviews of such vendors and cyber and information security requirements within its vendor contracts. Additionally, the Company leverages independent, third-party services to monitor the cyber and information security posture of key suppliers and vendors. The Company's Chief Executive Officer and Chief Financial Officer are briefed on a quarterly basis on the results of these reviews.

companyName: Matson, Inc.

ticker: MATX


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BXINFRA, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Infrastructure Strategies L.P.


text: We have in place a Security and Privacy Incident Response Plan that specifies incident classifications, reporting requirements, and which person must respond to such incidents. In most cases, cybersecurity management is handled by employees of the Company as described above, though if an incident does occur, external counsel and experts related to impacted systems or data may be engaged to supplement the Company's response.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: To date, we have not encountered cybersecurity threats or challenges that have materially impaired our operations, business strategy or financial condition.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: Our CIO is responsible for the strategic leadership and direction of the Company's information technology organization. As a part thereof, the Company has implemented an information security program, directly overseen by our CISO, that consists of controls and processes designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats, and which is based on recognized best practices including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard ("PCI DSS"). Our CISO, who has over 38-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry. Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.

companyName: CASEYS GENERAL STORES INC

ticker: CASY