text: As of the date of this Annual Report on Form 10-K, we have not experienced any significant cybersecurity attacks and, to date, the risks from cybersecurity threats have not materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For more information regarding the risks the Company faces from cybersecurity threats, see "Item 1A. Risk Factors––Risks Related to Our Business and Operations––We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks."

companyName: LQR House Inc.

ticker: YHC


text: To date, the Company’s business strategy, operating results, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior incidents. Our program is designed to identify, prevent, and mitigate cybersecurity events that would have a material adverse effect on the Company; however, the nature and sophistication of cybersecurity risks continue to evolve. No security framework, system, or control environment can fully eliminate the risk of a cyberattack or unauthorized access. Despite the Company’s safeguards to protect its systems, intellectual property, and confidential and personal information, vulnerabilities may persist that could be exploited by threat actors. See Item 1A, “Risk Factors—Risks Related to our Business.”

companyName: Phoenix Education Partners, Inc.

ticker: PXED

secItem: Item 1C


text: The Board of Directors maintains the ultimate responsibility for oversight of the Company's risks, including cybersecurity risks. The Board regularly receives presentations on matters of cybersecurity risk from management. Management discusses matters of particular importance or concern as they may be materially impacted by risk on an ongoing basis, and members of the Company's Executive Leadership Team ("ELT") are also available to members of the Board for discussion and review both during meetings of the Board of Directors and at other times.

companyName: 1st FRANKLIN FINANCIAL CORP


text: The Senior Director of Information Technology, in collaboration with our Cybersecurity Analyst, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. The Cybersecurity Analyst role reports directly to the Senior Director of Information Technology. The Senior Director of Information Technology has a 34 years of information technology experience, including with cyber threats.

companyName: SURMODICS INC

ticker: SRDX


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: GRI Bio, Inc.

ticker: GRI


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program using the NIST framework, as well as perform penetration testing.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities. Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The Company understands the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Consultants specializing in cybersecurity risk were engaged to assess, identify and manage risks from cybersecurity threats separately from the Company's other risk assessment processes. The cybersecurity risks assessed include operational risks, fraud, disaster recovery, and violation of data privacy or security laws. The assessment includes cybersecurity threats associated with the use of third-party service providers.

companyName: FORUM MARKETS Inc

ticker: FRMM


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders regarding potential risks.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: No known cybersecurity threats or incidents have materially affected, or are likely to materially affect, our business strategy, results of operations, or financial condition. While we maintain robust prevention and detection measures, we cannot eliminate all cybersecurity risks or guarantee absence of undetected incidents. For further details on cybersecurity risks, see "Item 1A. Risk Factors" in this Form 10-K.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: We have not had any reportable cybersecurity breaches, including what we may perceive or recognize as cybersecurity incidents or credible threats during the fiscal year ended December 31, 2023. To date, as a result, there has not been any material adverse effect on our business operations or financial condition. If there is an cybersecurity attack and an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of a cybersecurity infiltration. If there were a cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients financial and other data could be taken and used against us to damage our reputation or cause harm to our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be loss to our financial resources.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We will require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: VivoSim Labs, INC.

ticker: VIVS


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identifies areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.

companyName: WIDEPOINT CORP

ticker: WYY


text: As part of our governance structure, the Board of Directors, Chief Executive Officer and Director of IT play an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank and its vendors provide periodic reports to our Board of Directors, or Committee thereof, as well as to our senior management team as appropriate. These reports include updates on the Bank's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Bogota Financial Corp.

ticker: BSBK


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.

companyName: VOC Energy Trust

ticker: VOC


text: Management Oversight and Governance Management plays an important role in assessing and managing WTW's material risks from cybersecurity threats. The CISO is responsible for designing and implementing a security program and strategy. WTW's CISO has served in various roles in information technology and information security for over 32 years, including serving as CISO of several public companies. The CISO holds undergraduate and graduate degrees in mathematics and strategic information systems and has attained the professional certification of Certified Information Systems Security Professional. The CISO reports to the CIO. WTW's CIO has served in various roles in information technology for over 36 years.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Cybersecurity is a critical risk to our business. We rely on complex information technology systems and networks to conduct business, including communicating with employees and our distribution centers, ordering and managing materials from suppliers, selling and shipping products and analyzing and reporting results of operations, as well as for storing sensitive, personal and other confidential information. While we employ resources to monitor and protect our technology infrastructure and sensitive information, these security measures or those of our third-party vendors may not prevent all attempted security breaches or cyber-attacks. If our or our third-party vendors' information technology systems are damaged or cease to be available or function properly for an extended period of time, whether as a result of a significant cyber incident or otherwise, our ability to communicate internally as well as with our customers could be significantly impaired, which may adversely impact our business. Our acquisition strategy may also result in exposure to certain technology risks during integration of systems of acquired companies to our existing platform.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Management Oversight. While the Board of Directors and its Audit and Technology Committees oversee management's processes related to cybersecurity risks, management is responsible for identifying, monitoring and mitigating the material cybersecurity risks that face the Company. The Company's CRO is directly responsible for the overall cybersecurity risk management program which is a part of the Company's ERM Program. The CRO and the DIS oversee the information security department's implementation and maintenance of the cybersecurity security risk management program, including oversight of Vendors and regular reporting to the Board of Directors and its Audit and Technology Committees on the effectiveness of the cybersecurity risk management program. The DIS updates the CRO as appropriate, including as new developments or information related to cyber incidents arise.

companyName: CAMDEN NATIONAL CORP

ticker: CAC


text: Our risk management program is designed to identify, assess, and mitigate risk across various aspects of our company in which cybersecurity is a critical component. Our Chief Information Officer and Information Security Officer are primarily responsible for the cybersecurity program. The Chief Information Officer reports directly to the CEO and the Information Security Officer reports directly to the Chief Risk Officer to maintain independence. Our Information Security Officer provides periodic reports to the Board Audit Committee, the Enterprise Risk Management Committee, Operational Risk Committee and Information Security Committee regarding the Cybersecurity/Information Security Program.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: Our business has not been materially affected by cybersecurity incidents to date. For a discussion of how cybersecurity risks could materially affect us in the future, please see the risk factors set forth under the caption Part I, Item 1A, Risk Factors — Risks Related to our Operations.

companyName: Bloom Energy Corp

ticker: BE


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: As previously disclosed, in early 2019, we became aware of a ransomware attack that infiltrated and encrypted certain information technology systems, including systems containing critical business data. The financial impact of this incident was not material, and there were no changes to the previously released financial results or financial statements. As previously disclosed, immediately following the discovery, we commenced an investigation and were able to recover access to the compromised systems and restore their operation without significant loss of business data within weeks of the incident. Following the incident, we implemented additional protective measures and internal control policies and procedures. We also retained a professional cybersecurity investigation firm to conduct a full forensic analysis of the incident, and concluded that there was no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts within the Company's environment.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Our cybersecurity function, which comprises, in part, our information technology team, helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats, conducting scans of the threat environment, evaluating our (and our industry's) risk profile, using external intelligence feeds, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan, a vendor risk management program, employee training, data encryption, access controls, physical security, network security controls, systems monitoring, cyber insurance, and asset management, tracking, and disposal.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: At IGC, we are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our company's information assets and the personal information of our employees, customers, and stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Company intends to provide the Board of Directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: Enterprise Risk Management: CMS Energy and Consumers manage security risks, including cybersecurity risks, through a robust enterprise risk management program that includes people, processes, technology, and governance structures. The enterprise risk management program identifies risks that may significantly impact the business and informs the companies' risk-mitigation strategies. The enterprise risk management program is reviewed with the Board at least annually.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Risks from Cybersecurity Incidents To date, we have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our operations or financial condition. There can be no assurance that such effects may not occur in the future.

companyName: ExchangeRight Income Fund


text: Because we rely on third-party vendors, including for information technology services, we have processes to oversee and identify risks from cybersecurity threats associated with our third-party vendors. These processes include vendor screening and due diligence, contractual requirements, security assessments and audits, incident response planning requirements, and ongoing monitoring.

companyName: Waystar Holding Corp.

ticker: WAY


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, results of operations and financial condition.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: The Company's day-to-day management of cybersecurity risks is led by the Chief Information Security Officer ("CISO") with direct oversight from the Chief Information Officer ("CIO"). The Company's IR Plan includes a defined escalation matrix for critical or high severity information security events involving notifications to the CISO and CIO, who further escalate critical or high severity events to the Company's Crisis Management Team, which consists of senior management from IT, including the CIO and CISO, Human Resources, Risk and Internal Audit, Marketing and Communications, Legal and Finance. The Crisis Management Team further elevates sufficiently critical and high severity events to the Company's Cyber Incident Review Committee ("CIRC"), which consists of the CIO, Chief Financial Officer, Chief Accounting Officer, VP of Investor Relations, VP of Compliance, Risk and Audit, and General Counsel, or their delegates. Additional senior management from relevant business units are added to the CIRC as needed based on the nature of identified cybersecurity incidents. The CIRC preliminarily evaluates whether an incident is material and provides a proposal to the CEO and CFO, who work in consultation with the committee to make a final determination of materiality. Such determination is communicated to the Audit Committee of the Board.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a Bachelor of Science from Arizona State University and has been with us since 2019.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: We have a written incident response plan and we conduct tabletop exercises to enhance incident response preparedness. We use business continuity and disaster recovery plans to prepare for a potential disruption in the technology we rely on. We train our employees on cybersecurity awareness when they are hired and conduct additional training annually thereafter.

companyName: NuStar Energy L.P.


text: We have strategically embedded cybersecurity risk management within an enterprise-wide framework, ensuring that it permeates across various facets of our operations. This integrated approach encompasses administrative protocols, operational strategies, organizational structures, physical safeguards, and technical measures, all tailored to align with the scope and nature of our business.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Our Director of Information Technology is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of our management team. The Director of Information Technology works in coordination with the other members of our cybersecurity committee, which includes our Chief Financial Officer, Chief Accounting Officer and In-house Counsel. Our Director of Information Technology has served in various roles in information technology and information security for over 27 years. Our Director of Information Technology, in coordination with our cybersecurity committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. Through the ongoing communications with our organization, the Director of Information Technology and the cybersecurity committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Axe Compute Inc.

ticker: AGPU


text: Trust's cybersecurity risk management program is overseen by the Executive Committee of the Managing Owner. Periodically, the Chief Information Security Officer of the Managing Owner provides an update to the Executive Committee of the Managing Owner on the Trust's cybersecurity threat risk management and strategy processes, including potential impact on the Trust, the efforts to manage the risks that are identified, and the Trust's disaster recovery preparations.

companyName: Frontier Funds


text: Quarterly updates are provided by the CISO to the Cybersecurity Governance Committee comprised of cross functional senior management regarding the effectiveness of cybersecurity program and its ability to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Cybersecurity Governance Committee is responsible for monitoring and coordinating enterprise cybersecurity policy and strategy, and for providing guidance to key management and oversight bodies. Our cybersecurity program includes a risk-based incident response plan that provides a documented framework for handling incidents including coordination across multiple parts of the Company.

companyName: Ingersoll Rand Inc.

ticker: IR


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk. Cybersecurity training is conducted annually, in addition to periodic simulations and exercises to test the efficacy of this training, and expanded training is required for specific roles.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: The audit committee of the board of directors (the "Audit Committee") is responsible for establishing and monitoring the integrity and effectiveness of controls and other procedures, which are designed to ensure that (1) all information required to be disclosed is recorded, processed, summarized, and reported accurately and on a timely basis, and (2) all such information is accumulated and communicated to management and the Company's board of directors, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the Audit Committee's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, the Company's cybersecurity processes have been integrated into the Company's overall processes.

companyName: Sow Good Inc.

ticker: SOWG


text: The MSP and we developed a cybersecurity incident response plan that sets forth roles and responsibilities for the identification, assessment, triage, communication and resolution of cybersecurity incidents.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: We have implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We have mandatory training in the areas of cybersecurity, privacy, and confidential information handling. We also conduct regular phishing training and simulations for our employees and contractors. We provide extensive specialized role-based training to technical professionals in cybersecurity, secure application development, and other focus areas. We also conduct periodic tabletop exercises to validate our preparation for cyber events.

companyName: CATERPILLAR INC

ticker: CAT


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President, Information Technology, Associate Director of Information Technology Operations, General Counsel and Chief Compliance Officer, and Chief Operations Officer. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Vice President of Information Technology and Associate Director of Information Technology Operations report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on an annual basis.

companyName: G1 Therapeutics, Inc.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Senior Director of IT works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our Cybersecurity Incident Response Plan is overseen by our Cybersecurity Incident Response Team ("CSIRT"), which is led by our Chief Information Officer ("CIO"). Our CIO is an information technology executive with over 20 years of CIO and Chief Technology Officer experience at publicly traded and privately held companies. His experience has included cybersecurity leadership throughout his executive career. He holds a Bachelor of Science degree in Computer Science and an MBA. The other members of the CSIRT include our Vice President of Information Technology who has over 25 years of experience in IT infrastructure, cybersecurity and compliance. He holds a Bachelor of Sciences degree in Electrical Engineering and an MBA. Our virtual Chief Information Security Officer also serves on the CSRIT and is a seasoned vCISO and Principal Security Consultant. He holds multiple certifications including MIS, CISSP, GSEC, GPEN and GCFE. Our IT Compliance and Security Manager also serves on the CSIRT and has over 20 years of IT experience in compliance, audit and security. She holds a Bachelor of Science degree in Information Technology and a Masters of Science degree in Organizational Leadership. The CSIRT is responsible for the Company's cybersecurity risk management processes described above, including maintaining systems that are designed to preempt, detect and monitor cybersecurity threats, as well as identifying and responding to cybersecurity incidents.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: Information security and privacy are important concerns, with an escalating cyber-threat environment and evolving regulatory requirements driving continued investment in this area. Our information security program is designed to meet or exceed industry best practices, and is integrated into our broader ERM framework. We are subject to a number of cybersecurity and data privacy laws and regulations, such as those promulgated by the BMA, NYDFS and EU. Pursuant to applicable regulations, we have established and maintain a cybersecurity program designed to protect our information technology systems and customer data. Our program is designed to comply with all applicable cybersecurity regulatory requirements, including disclosure requirements, and we continue to evaluate and assess our compliance in the changing regulatory environment. It is likely that we will be subject to new regulations that could adversely affect our operations or ability to write business profitably in one or more jurisdictions. We cannot predict what, if any, regulatory actions may be taken with regard to "big data" or other emerging technologies, but any actions could have a material impact on our business, business processes, financial condition, and results of operations.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: TIAA's cybersecurity team, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Fund and the Advisers. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering, and have cybersecurity leadership experience in other major financial institutions.

companyName: Nuveen Churchill Private Capital Income Fund


text: Our data is dynamically backed up to mitigate against data loss. To prevent unauthorized access and data breaches, we encrypt sensitive data both in transit and at rest. We have also implemented access controls and multi-factor authentication to ensure that only authorized personnel can access sensitive information. We also utilize third-party information technology systems vendors to conduct constant network and endpoint monitoring.

companyName: Investview, Inc.

ticker: INVU


text: Cybersecurity and Data Privacy Oversight Montrose maintains a dedicated cybersecurity team, led by our CISO and reporting to our CIO. Our CIO has deep expertise in cybersecurity and data management, as well as technical strategy and infrastructure, as part of his over 20 years of experience serving in this and similar roles across multiple organizations. Furthermore, our CISO is a Certified Information Security Manager (CISM) and brings over 25 years of experience in information technology, governance, compliance, and risk management.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, see Item 1A, "Risk Factors".

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Our Cybersecurity Incident Response Policy is designed to escalate certain cybersecurity incidents to members of senior management depending on the circumstances, including our Disclosure Committee, as appropriate. Senior management works with the Company's cybersecurity incident management team to help the Company mitigate and remediate notified cybersecurity incidents, comply with applicable laws, regulations and contractual provisions and engage advisors as appropriate. In addition, such policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: ACELYRIN, Inc.


text: Mexco maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. We have implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: We engage a security operations platform provider to assist us in monitoring, assessing and managing potential cyber events. We also perform periodic cyber maturity assessments to measure our cybersecurity profile against industry peers and standards.

companyName: Verastem, Inc.

ticker: VSTM


text: The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of the Company's decision-making processes. The Company regularly assesses risks from cybersecurity threats and monitors its computer networks for vulnerabilities. To defend the Company's computer systems from cyberattacks, the Company uses various security tools that are designed to help the Company protect against, identify, monitor, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our board has adopted a policy regarding cybersecurity and delegated administration of the policy to our President and Chief Executive Officer.

companyName: OGLETHORPE POWER CORP


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Some of the other steps we have taken to detect, identify, assess, classify, and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Complying with the Payment Card Industry Data Security Standard (PCI-DSS); • Implementing an Information Security Management System (ISMS) and Privacy Information Management System (PIMS) which are certified as meeting the requirements of the ISO 27001 & ISO 27701 standards, respectively; • Engaging an industry-leading, suitably qualified and experienced third party to independently evaluate our information security systems on a regular basis; • Adopting a vendor risk management program, which includes receiving the results of cybersecurity and data privacy audits conducted on certain vendors engaged in high-risk data processing; • Providing security and data protection training and awareness to our employees, contractors and key partners with access to any sensitive information and systems; and • Maintaining cyber liability insurance.

companyName: Bally's Corp

ticker: BALY


text: Third-Party Management: We screen venders, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems..

companyName: CEVA INC

ticker: CEVA


text: As discussed above, to support its preparedness Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: 24x7 Security Operations Center (SOC); and Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Our IT leadership reports to the Board on an annual basis on cybersecurity matters and, as necessary, when incidents arise in accordance with our cybersecurity incident communication protocols. Our Board, specifically our Audit Committee, oversees cybersecurity risks and we believe contains the necessary expertise to perform those duties, including specific industry experience within information technology. Additionally, Prologis' cybersecurity risk management practices are reviewed and benchmarked against its peers through regular participation in a third-party security benchmarking survey. Our IT infrastructure is externally audited as part of our Sarbanes-Oxley audit process and our controls include information security standards. We also maintain standalone cybersecurity insurance and strive to adhere to local cybersecurity regulations in all the countries we do business. We believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and are not reasonably likely to materially affect Prologis, including its business strategy, results of operations or financial condition. Please refer to "Our business and operations could suffer in the event of system failures or cybersecurity attacks" under Item 1A. Risk Factors.

companyName: Prologis, Inc.

ticker: PLD


text: e) Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Our information technology employee regularly monitors our information technology systems and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in consultation with our Chief Executive Officer. To the extent necessary, our Chief Executive Officer reports such risks to our Board.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH


text: Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. He has 25 years of experience in IT roles including 15 years of experience in security leadership. He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker ("CEH"), and numerous vendor specific certifications.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our processes include controls that our Director of Information Technology and our Technology Department implement, which seek to protect our company, assets, information, and our employees from cyber threats, and provide regular education for our employees. For example, as part of our cybersecurity program, we have implemented controls that are designed to prohibit unauthorized access to our systems. These include password requirements, onboarding and termination processes, multi-factor authentication, and other condition-based access controls. We also use external controls and security systems that identify and prevent malicious activity or unauthorized access on an ongoing basis such as firewalls, endpoint protection, intrusion detection, and email security, among others.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: CNX maintains a comprehensive cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including appropriate internal risk assessment and policy implementation, incorporating a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies designed to increase security for our information, facilities, and infrastructure.

companyName: CNX Resources Corp

ticker: CNX


text: Through the Provider, automated security tools are used to monitor all Windows-based systems and provide defense against cyberattacks perpetrated on or against these systems and to protect internal systems from known and unknown cybersecurity threats. These security tools include:

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Cybersecurity and Risk Management Strategy Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity, and availability of such information seriously and invest significant time, effort, and resources into protecting such information. Our cybersecurity risk management strategy is designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.

companyName: APPFOLIO INC

ticker: APPF


text: We maintain a centralized incident response process with a third-party forensic partner on retainer. In addition, we have cybersecurity insurance policies in place. Roper maintains a Cybersecurity Incident Response Plan ("CSIRP"), which requires each Roper business to designate a Cybersecurity Incident Response Team that is responsible for receiving, reviewing, and responding to cybersecurity incident reports and activities. Cybersecurity incidents are required to be promptly reported to the Roper cybersecurity team, who then monitors such incidents through their resolution. We work on security awareness with our employees throughout the year with annual cybersecurity training and monthly simulated phishing campaigns to better identify and report unusual behavior and to mitigate the likelihood and impact of possible cybersecurity incidents.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process to identify and mitigate risks from third parties, such as service providers, suppliers, and vendors.

companyName: CADIZ INC

ticker: CDZI


text: Cybersecurity Risk Management and Strategy PriceSmart has developed, implemented, and maintained a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical technology systems, data, and information. We have implemented processes and protocols designed to monitor, identify, mitigate, and prevent material risks associated with cybersecurity threats and incidents relevant to internal networks, business applications, customer-facing applications, customer payment systems, and business operations. Cybersecurity represents an important component of our overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment.

companyName: PRICESMART INC

ticker: PSMT


text: In the event of a cybersecurity incident, the Vice President of IT is equipped with a incident response and recovery plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. The board of directors and senior management also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.

companyName: CHUY'S HOLDINGS, INC.


text: We have not previously experienced a cybersecurity event that was determined to be material, and our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats. For additional information regarding risks from cybersecurity threats, please refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Our cybersecurity team is led by our Vice President, IT, who reports to our Senior Vice President, Operations. Our Vice President, IT, has an M.S. degree in computer science and 31 years of experience in the information technology industry. Our cybersecurity functions include representatives from information technology, information security, legal, impacted product teams or products and other departments as needed. This team reviews enterprise risk management-level and product-based cybersecurity risks. This team is responsible for assessing and managing our material risks from cybersecurity threats and our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants.

companyName: Cambium Networks Corp

ticker: CMBM


text: Board Oversight—The Audit Committee of the Board of Directors oversees the Company's cybersecurity program. The cybersecurity team updates the Audit Committee on at least a quarterly basis to discuss the effectiveness of the Company's risk management program, potential and identified threats, remediation and mitigation plans, and other topics as requested by the Audit Committee. The Audit Committee regularly reports to the full Board of Directors and management reports on specific matters as requested by the Board of Directors.

companyName: National CineMedia, Inc.

ticker: NCMI


text: We have developed a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data, and products. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, threat monitoring and detection tools, threat containment methods, risk assessments, and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. At least annually, we undertake several assessments to evaluate our cybersecurity controls.

companyName: Acorda Therapeutics, Inc.


text: The Chief Information Security Officer ("CISO") reports to the CSO and oversees the Company's Security Operations Center ("SOC"). The CISO establishes and oversees the execution of prioritized cybersecurity mitigation plans for the Company. Zebra's current CISO was appointed to the role in June 2018 and has held multiple leadership roles overseeing IT functions during his 14 years with the Company, including driving efforts within the cybersecurity function.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. As of the reporting date, the Company updated and published other cybersecurity policies and procedures for access control, including remote access; business continuity; information security related to governance, managing and planning; risk management; and vendor risk and management, which leverages and coordinates with procedures in place for the accounting payable process.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition, but the Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks the Company faces can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.

companyName: Stepstone Private Credit Fund LLC


text: The Company has adopted the Factor Analysis for Information Risk (FAIR) assessment approach, an industry standard risk assessment methodology. Under the FAIR approach, the Company identifies, catalogs, assesses and manages material cyber risks by: (a) documenting threat actors and organizations (i.e., cybercriminals, nation state actors, hackers, company insiders), (b) analyzing their likelihood of attack, their motives, capabilities and tactics; (c) assessing the potential impacts of such threat actor attacks against company assets, and documented vulnerabilities (or cyber exposures), both internally and externally of the organization; and (d) evaluating the implemented security controls and effectiveness of those controls against defined risk scenarios. The Company rates vulnerabilities based on the criticality of a vulnerability and/or the value of the asset associated with the vulnerability (people, systems, customer data, money). When a residual risk exceeds the desired threshold set by the Board-defined risk appetite of the organization, additional controls are recommended and implemented to reduce the potential risk to an acceptable level and provide appropriate management of the cyber risk exposure.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: We work with third-party service providers from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: In designing our Information Security Program, we refer to established industry frameworks - in particular, the Federal Financial Institutions Examination Council (FFIEC) and guidance and best practices from the National Institute of Standards and Technology (NIST). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity, and availability of sensitive information and systems. NIST is part of the U.S. Department of Commerce and among other initiatives, develops cybersecurity standards, guidelines, and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Activities range from producing specific information that organizations can put into practice immediately to longer-term research that anticipates advances in technologies and future challenges. The Company utilizes these frameworks to assist with the design of our Information Security Program, including risk mitigation controls and processes. While we believe our information security program is well-designed and appropriate for our organization, the sophistication of cyber threats continues to increase and the Company's cybersecurity risk management and strategy may be insufficient and may not be successful in protecting against all cyber incidents. Accordingly, no matter how well designed or implemented the Company's controls are, it may not be able to anticipate all cyber security breaches, and it may not be able to implement effective preventive measures against such security breaches in a timely manner. For more information on how cybersecurity risk may affect the Company's business strategy, results of operations or financial condition, please refer to Item I A. Risk Factors - Risks Related to Cybersecurity, Data and Fraud.

companyName: First Financial Northwest, Inc.


text: We maintain a cybersecurity awareness training program for employees, which is provided during onboarding and on an annual basis thereafter. Our training program includes simulated phishing campaigns, which are designed to increase awareness and detection and to equip our personnel with effective tools to identify and address cybersecurity threats.

companyName: Absci Corp

ticker: ABSI


text: The Company utilizes various third-party service organizations for critical areas of operations, including stockholder transfer agent services, accounting software, financial reporting software and regulatory filings, and mineral management software. The Company obtains System and Organization Controls ("SOC") reports for each vendor and ensures that internal controls are designed and implemented to adequately meet the applicable user controls identified within the SOC report for each vendor.

companyName: RESERVE PETROLEUM CO


text: As a provider of cybersecurity products and services, it is critical for us to identify and implement protective measures across our enterprise and products, continuously driving improvements to our security approach. Our in-house global threat research team, Zscaler ThreatLabZ, a team of more than 150 security experts, collectively works to identify and prevent emerging threats, using malware reverse engineering, behavior analytics, data science and AI. We use the threat intelligence generated by ThreatLabz and other sources to implement security checks and reviews throughout our product development lifecycle. Our internal security teams and external cybersecurity auditors continuously evaluate our products, including by performing regular penetration tests and risk assessments to identify potential vulnerabilities.

companyName: Zscaler, Inc.

ticker: ZS


text: Members of the KKR CIRT include members of the firm's legal, technology, compliance, risk, public affairs, fundraising and finance groups. KKR has established a notification decision framework to determine when the KKR CIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including the risk and operations committee, senior members of management, and our Board of Directors or its committees.

companyName: KKR & Co. Inc.

ticker: KKR


text: Cybersecurity risk management process Our Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to our network, infrastructure, computing environment, and to third parties. We periodically assess the design of our cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and we seek to implement improvements to our controls in response to that assessment. Our Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect our clients', associates', and firm data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, recovery planning, and providing appropriate public disclosure of cybersecurity risks and incidents when required. In addition, we maintain a global training program for our associates about cybersecurity risks and requirements and conduct regular phishing email simulations in order to test our associates' understanding of these risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Accountability Framework which measures performance across departments and systems and ensures that those identified as responsible for meeting objectives are aware of the results and work with the cyber risk governance team leader to achieve and enhance them. With consistent feedback and the ability to reference established metrics, we can successfully monitor, review, and enforce cyber risk governance plans.

companyName: Zedge, Inc.

ticker: ZDGE


text: Our program includes regular risk assessments, penetration testing performed by the internal team and independent third parties, patch management, and vulnerability scanning to identify potential threats and vulnerabilities. We have also implemented a robust security awareness program that includes regular phishing tests and requires employees to undergo annual security awareness training. Our cybersecurity strategy is focused on establishing the zero-trust security model to protect our information assets' confidentiality, integrity, and availability. We also have an incident response process and various incident response plans that are designed to provide timely and effective actions in the event of a cybersecurity incident. Our incident response plan includes procedures for determining the root cause and impacts of the incident, containment actions to mitigate the impacts, and notifying affected parties.

companyName: Domtar CORP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors - Risks related to our business - Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. CITIZENS, INC.

companyName: CITIZENS, INC.

ticker: CIA


text: If the system is infected with ransomware, there is a risk of data being encrypted, resulting in business stoppages and information leaks. We have prepared multiple backup mechanisms and recovery procedures in case of damage.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: To safeguard our networks and systems, Westlake has a dedicated cybersecurity organization overseen by its Chief Information Security Officer, which operates within its information technology department overseen by its Chief Information Officer. Westlake's cybersecurity organization employs multiple security controls, such as firewalls, spam protection, web filtering, endpoint detection and response software, controlled access, vulnerability management, redundancies, patching, and regular onsite and offsite backups. Westlake's cybersecurity organization also uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and risk-based performance monitoring.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our Information Technology team. We regularly conduct vulnerability testing and security audits. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use. In addition to our internal cybersecurity capabilities, we also at times engage assessors, auditors, or other third parties to assist with the assessment, identification, and management of cybersecurity risks.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: The CISO reports directly to the CDIO, who is a member of the Kellanova Executive Management Team. The Company's CDIO has technology experience overseeing and executing technology strategies in complex, global, and matrixed environments. The CDIO has been in role since February 2019, bringing experience from overseeing and executing technology as European CIO at the Company, and over 20 years of experience leading IT strategy and change initiatives in the consumer packaged goods and manufacturing industries.

companyName: KELLANOVA


text: Management is responsible for the day-to-day administration of the Company's cybersecurity policies, processes, practices and risk management. The Board, including through its dedicated Cybersecurity and Privacy committee (the "Committee"), oversees the various cybersecurity risks facing the Company and the Company's efforts to mitigate those risks.

companyName: Salesforce, Inc.

ticker: CRM


text: Our information technology functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including internal and external audits, penetration and vulnerability tests, automated tools, subscriptions to reports and services that identify cybersecurity threats, analysis of reports of threats and actors, use of external intelligence feeds, evaluations of our and our industry's risk profile, evaluation of threats reported to us, threat assessments for internal and external threats, scans of internal systems for threats, and incident response simulations (including third-party-conducted red/blue team testing and tabletop incident response exercises). We engage certain external service providers, including consultants, independent privacy assessors and computer security firms, as appropriate, to assess, test or otherwise assist with aspects of our security controls, including cybersecurity incident containment and remediation efforts, and enhance our cybersecurity oversight. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, cybersecurity consultants, forensic investigators, cybersecurity software providers, managed cybersecurity service providers, and professional services firms (including legal counsel).

companyName: Immunovant, Inc.

ticker: IMVT


text: Protecting the privacy of customer and personnel information is important to us, and we maintain security protocols and processes, including ongoing training and education for all personnel, designed to combat the risk of unauthorized access or inadvertent disclosure.

companyName: Electromed, Inc.

ticker: ELMD


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Governance.

companyName: CapStar Financial Holdings, Inc.


text: We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Our Chief Financial Officer and Senior Director of Information Technology are primarily responsible for assessing and managing our material risks from cybersecurity threats w ith assistance from third-party service providers. Our Senior Director of Information Technology leads our internal team and has over 20 years of cybersecurity experience, including the last 10 years in leadership positions, enabling him to build and transform successful cybersecurity programs and initiatives across several enterprises. His active associations include Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER), Information Systems Security Association (ISSA), and Forum of Incident Response and Security Teams (FIRST), and has held many technical certifications including Strategic Planning, Policy, and Leadership (GSTRT), Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP). Our third-party vendors include assessors, consultants, and auditors holding (but not limited to) the following relevant certifications: Certified Information Systems Security Architecture Professional (CISSP-ISSAP), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and Certified Ethical Hacker (CEH).

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Oversee Third-party Risk The Company recognizes that cybersecurity threats and risks are amplified with the addition of third-party digital service providers. In response, the Company implements stringent processes to oversee and manage these risks. It conducts thorough security assessments of all third-party providers before engagement and maintains ongoing monitoring to ensure compliance with its cybersecurity standards. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The monitoring includes quarterly assessments made by the contracted Chief Information Officer, or CIO, and on an ongoing basis by its dedicated cybersecurity staff. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: YORK WATER CO

ticker: YORW


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, however the full Board is typically present for Information Technology (IT) and Cybersecurity briefings. As part of it's oversight role, the Audit Committee receives reporting about the Company's cybersecurity program, activities, threats and incidents (if any) through periodic updates. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, who reports directly to our CEO. Utilization of an outsourced IT infrastructure team allows Data I/O to access the necessary breadth and depth of leading cybersecurity programs, staff, expertise, and tools. The IT infrastructure team monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity function, including the operation of the Company's incident response plans, which include appropriate escalation to the CFO, CEO and the Audit Committee.

companyName: DATA I/O CORP

ticker: DAIO


text: The Cybersecurity Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as amended. These NIST functions are used as high-level categories to organize and report on the status of the Cybersecurity Program and are tailored to the Adviser's business objectives. There are areas within the NIST framework that the Adviser might not find applicable to its business and not necessary to fulfill the objectives of the Cybersecurity Program. The Adviser utilizes an aggregated approach to cybersecurity and considers the acceptance, avoidance, transfer, and mitigation of risks in attaining long term business objectives and minimizing financial loss. In terms of security incident and event management, the Adviser implements multiple technologies (including, but not limited to, enterprise grade next generation firewalls, well-known anti-malware protection, application whitelisting, and end detection and response software) in different layers of the Adviser's network, including utilizing a third-party vendor that provides monitoring of the Adviser's systems on a 24 hour/day, seven days/week basis. In addition, the Adviser has developed customized firm-wide cybersecurity training sessions for employees with the assistance of an outside vendor. Cybersecurity training is provided to all new employees upon hire and annually for all employees. In addition, the Adviser conducts phishing training on a monthly basis and sends out periodic newsletters on pertinent cybersecurity-related topics and events. In 2022, the Adviser engaged a consultant to conduct an independent cybersecurity risk assessment, and the Adviser has since then implemented all priority recommendations from this engagement. Other non-priority recommendations have been considered for implementation over time.

companyName: First Eagle Private Credit Fund


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. During fiscal 2023, we partnered with an external cyber security firm to leverage their expertise and guidance in fortifying our systems from evolving threats. We also have third-party risk management processes in place used to address the risks involved with engaging third parties in our cybersecurity programs. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.

companyName: Citi Trends Inc

ticker: CTRN


text: Disclosure Controls and Procedures In addition to the information security risk committee discussed above, we maintain a disclosure committee with certain responsibilities that include among other things, the discussion of cybersecurity matters for materiality, proper internal reporting systems and incident disclosure evaluation. The disclosure committee also has a cybersecurity subcommittee that meets at least quarterly to discuss ongoing internal and external cyber-events, as well as mapping out the response process in the event of a cybersecurity incident that may reasonably be viewed as potentially material, including assessing the incident, materiality and disclosure obligations.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures. We also restrict vendors' access to our organizational systems through a segmented and controlled environment which is monitored by us, and perform detailed and customized risk assessments of certain vendors, including their ability to protect data from unauthorized access.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") and Chief Legal Officer ("CLO"), and the SVP overseeing cybersecurity ("SVP Sponsor").

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: The Audit Committee charter provides that it shall review, at least annually, the Company's cybersecurity program and shall receive frequent updates on cybersecurity and the development of Company's cyber strategy and the Company's corresponding information technology emergency response plan. Our director, information security, reports at least quarterly to the Audit Committee during its regularly scheduled meetings, and engages in weekly dialogue with the Chair of the Audit Committee and Senior Vice President, Secretary and General Counsel, including with respect to matters identified by our information technology department.

companyName: GRAYBAR ELECTRIC CO INC


text: Cybersecurity threats have not materially affected, and are not reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition while its operations are suspended. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact us by causing a disruption to our operations, if any, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business, if any, and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including its their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company's systems and information.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company plans to implement processes to oversee and manage these risks. We plan to conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring will include periodic assessments by our Chief Executive Officer ("CEO"). This approach will be planned to design to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Policy ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. The CIRP provides a process for escalating certain cybersecurity incidents to the Board and members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.

companyName: DHI GROUP, INC.

ticker: DHX


text: Technical Safeguards: The Company uses an array of complex technologies and services to protect its information systems and employees from cybersecurity threats. Examples include firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls. These safeguards are evaluated and improved through learnings derived from vulnerability assessments, penetration tests, and cybersecurity threat intelligence.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency RMBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives reports from management, the Manager's information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Our CFO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The incident management team helps us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the board of directors for certain cybersecurity incidents. The board receives periodic reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: DFIN maintains a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The program also includes evaluations of existing suppliers and third parties for ongoing risk. A supplier's classification rating determines the frequency with which it is evaluated. For example, those identified as critical suppliers are monitored on a quarterly basis, or more frequently if an event occurs that could elevate the risk, and assessed at a higher frequency than other suppliers. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that are determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: We have implemented a comprehensive set of information security policies, standards, and related trainings to promote awareness for prevention and detection of cybersecurity risk. Every employee is required to review, acknowledge, and/or complete the information security framework in connection with the employee's onboarding process at the time they are hired. Additionally, each employee is required to formally review and understand any changes to these policies and standards and complete additional training on at least an annual basis. These policies, standards, and trainings address, but are not limited to, the following topics: data privacy and security, password protection, internet use, computer equipment and software use, e-mail use, risks associated with social engineering, and best-practices and safety. Our internal audit team and bank examiners audit and review our information security program and risk mitigations on an annual basis. Additionally, external auditors audit specific components of the information security program as part of the annual financial statements audit. We adhere to and implement NIST guidelines and utilize the American Banker's Association recommended Cyber Risk Institute Profile to annually evaluate our information security practices.

companyName: FB Financial Corp

ticker: FBK


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: Although we believe we have a robust program to protect against cybersecurity risks, we may not be able to prevent a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for further discussion of cybersecurity risks.

companyName: EQUINIX INC

ticker: EQIX


text: The Risk Committee, in collaboration and coordination with the Board of Directors and its other committees, is responsible to review risks related to information security, cybersecurity, and technology, as well as the steps taken by management to control for such risks.

companyName: Santander Holdings USA, Inc.


text: As of June 30, 2025, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors - Risks Related to our Business and Products" in Item 1A of this Form10-K.

companyName: iPower Inc.

ticker: IPW


text: Our third-party consultant provides and assists with implementation on a formal IT Security Policy to provide appropriate governance over information security including control requirements for change management and patching, multifactor authentication, data backup, security monitoring, and mobile device management. Management coordinates with its third-party consultant on security controls and any issues are reported to the Audit Committee. In addition, we carry insurance that provides levels of reimbursement protection against the potential losses arising from a cybersecurity incident; however, the insurance may not cover all the costs that we might incur, and we may suffer have not had any reportable cybersecurity breaches, including what we may perceive or recognize as cybersecurity incidents or credible threats during the fiscal year ended December 31, 2024. To date, as a result, there has not been any material adverse effect on our business operations or financial condition. If there is a cybersecurity attack and an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of a cybersecurity infiltration. If there were a cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients financial and other data could be taken and used against us reputationally or to damage our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be loss to our financial resources. Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants and tangential expenses will all result in damage to our business and our financial resources.

companyName: CEA Industries Inc.

ticker: BNC


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. These threats include but are not limited to: (i) ransomware and malware attacks; (ii) endpoint attacks; (iii) compromised business email and other social engineering threats; and (iv) vulnerabilities related to inadequate patch management. Our licensees, suppliers, contractors, and consultants also face similar cybersecurity risks, which could have an adverse impact on our business. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information technology systems or data or those of our partners or contractors are compromised, our business could experience adverse consequences, including regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; and loss of revenue or profits" and "Compliance with the stringent and changing obligations related to data privacy and security is an onerous and resource-intensive process. Our actual or perceived failure to comply with any data privacy or security obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences."

companyName: XOMA Royalty Corp

ticker: XOMA


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, and how, if realized, those risks are reasonably likely to materially affect us, see the risk factor entitled "Our financial performance and our reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents" in Item 1A- Risk Factors.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended June 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC