text: Neither cybersecurity incidents nor cybersecurity threats have materially affected our company, including our business strategy, results of operations, or financial condition. We are not aware of any cybersecurity threats that are reasonably likely to materially affect our company. Refer to the risk factor captioned "Our business and operations may be adversely affected by information technology ("IT") system failures or cybersecurity or data breaches" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company. Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and interim CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Planet Fitness, Inc.

ticker: PLNT

secItem: Item 1C


text: Our management team's experience includes extensive experience working in the information technology field and securing corporate information technology systems, including engaging with third party security vendors to perform cyber risk assessments and penetration testing.

companyName: HilleVax, Inc.


text: Our board of directors oversees consideration of strategic risks to the Company as well as management's actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Information Officer ("CIO"), Chief Risk and Privacy Officer, General Counsel, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO"), and other officers review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary. The Company's Chief Risk and Privacy Officer, CISO, Vice President of Internal Audit and certain members of this management team and select members from their teams convene monthly to manage cybersecurity and privacy governance. The Chief Risk and Privacy Officer holds similar quarterly reviews with the Audit Committee Chair of the Company's Board of Directors, each committee chair, and other directors including the CEO, CFO, and General Counsel. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team ("EMT"), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, CIO, and Chief Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.

companyName: KELLY SERVICES INC

ticker: KELYA


text: Our cybersecurity program includes the assessment, identification and management of material risks from cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, our annual enterprise risk management assessment considers cybersecurity threat risks alongside other risks as part of our overall risk assessment process. In addition, we engage with consultants, internal and external auditors and other third parties to gather certain insights designed to identify and assess material cybersecurity threat risks, their severity and potential mitigations. We also employ a range of tools and services, depending on the environment, including network and endpoint monitoring, vulnerability assessments, penetration testing and tabletop exercises, to inform our cybersecurity risk identification and assessment. As part of our cybersecurity program, we maintain an incident response plan that includes processes to assess the severity of, escalate, contain, investigate and remediate certain cybersecurity incidents, as well as to comply with applicable reporting obligations.

companyName: AIR LEASE CORP

ticker: AL


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors, the section titled "Risk Factors—Risks Related to our Business and Our Industry— Internalsystem or service failures could disrupt our business and impair our ability to effectively provide our services and products to our customers, which could damage our reputation and adversely affect our revenues and profitability." and " As a U.S. defense contractor, we are vulnerable to security threats and other disruptions that could negatively impact our business. "

companyName: Laser Photonics Corp

ticker: LASE


text: Cybersecurity risk management is integrated into the Company's overall enterprise risk management (ERM) process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by our information technology security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cybersecurity Management report on cybersecurity risk management and related matters to the audit committee of the board of directors, as part of their ongoing evaluation and oversight of overall enterprise risk pursuant to non-exclusive authority delegated by the board of directors.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations.

companyName: iTeos Therapeutics, Inc.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading information technology and cybersecurity teams. Our CISO has over 20 years' experience in the technology and security fields, including over 10 years in executive security leadership roles. Our CISO and senior members of the cybersecurity team also participate in both private and public knowledge shares, including maintaining ongoing relationships with government and non-public entities.

companyName: TransUnion

ticker: TRU


text: The Director of Technology Services is responsible for overseeing the information security program as well as members of the Information Technology department that execute our program with oversight by members of our senior leadership team. These members of our Information Technology department have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance and systems. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Board on any appropriate items.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: We employ Information Technology staff to analyze and protect our network infrastructure. Members of our IT staff have relevant training and education in computer networks and systems, information security and intelligence, and hold industry certifications related to network security, enterprise IT governance, and risk and information systems control. In addition, our employees' network with peer banks, participate in industry groups, and attend ongoing training to stay abreast of cybersecurity threats and best practices.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: We have implemented and maintain a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats to (i) our information systems and data, which include critical computer networks, third-party hosted services, communications systems, hardware and software, and (ii) critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' data. Our cybersecurity program includes an information security policy, access management policies, an open-source policy, security incident response processes, and a supply chain policy, in addition to the secure design and vendor management programs described below. For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Snowflake Inc.

ticker: SNOW


text: The communication between management, the ISSG, and the Credit and Risk Committee facilitates a holistic understanding of cybersecurity risks, ensuring proactive measures are in place to safeguard Bancorp's operations, preserve its financial stability, and maintain the trust of its stakeholders.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: We maintain various information security processes designed to identify and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and data, including personal data, intellectual property and confidential information that is proprietary, strategic or competitive in nature. Our cybersecurity function includes representatives from information technology, engineering, information security, legal, impacted business units or products and other departments as applicable and help identify, assess and manage the Company's cybersecurity threats and risks.

companyName: AAON, INC.

ticker: AAON


text: when appropriate, use of external subject matter specialists, including assessors, insurers, and consultants, to provide incident response services and risk assessments; engagement in security practices that include physical, administrative, and technical safeguards of systems and hardware;

companyName: SMITH MIDLAND CORP

ticker: SMID


text: We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program. We also align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including the head of our IT department. The head of IT is responsible for integrating cybersecurity risk considerations into our overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Kura Oncology, Inc.

ticker: KURA


text: We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and reports to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents, including any prior cybersecurity incidents, that have materially affected the Company's operations, business strategy, results of operations and cash flows. The Company faces various ongoing risks from cybersecurity threats that, if realized, are reasonably likely to lead to losses of sensitive information, critical infrastructure or capabilities essential to the Company's operations and could have a material adverse effect on the Company's reputation, financial position, results of operations and cash flows. See "Item 1A. Risk Factors - The Company's business could be materially and adversely affected by security threats, including cybersecurity threats, and other disruptions" for additional information.

companyName: PIONEER NATURAL RESOURCES CO


text: The Board, in coordination with the Audit and Finance Committee, oversees our risk management program, including the management of cybersecurity threats. The Board and the Audit and Finance Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit and Finance Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds. Annually, the Board and the Audit and Finance Committee discuss our approach to overseeing cybersecurity threats with our Chief Technology Officer, or CTO, and other senior management members.

companyName: CareDx, Inc.

ticker: CDNA


text: Our CISO oversees our cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats, including aligning programs with industry standards, conducting tabletop exercises, providing education/training and taking other preventive measures. Our CISO coordinates with legal counsel and third-party experts to assess and manage material risks from cybersecurity threats. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. Our CISO or a delegate informs the IRT of cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in our incident response plan and related processes. The CISO, in collaboration with legal counsel, is primarily responsible for advising our chief executive officer ("CEO") and chief financial officer ("CFO") regarding cybersecurity disclosures in public filings. The CISO also notifies the Audit Committee chair of any material cybersecurity incident.

companyName: CHS INC

ticker: CHSCP


text: The Company engages reputable third parties to conduct various risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: The Board, through the Information Technology Steering Committee, works with senior management and other employee committees to oversee the development, implementation, maintenance, and administration of the Information Security Program, which is aligned and integrated into Ohio Valley's overall risk management system and processes. The Information Technology Steering Committee itself is comprised of diverse directors and officers of the Bank with vast knowledge and years of banking experience. The Information Security Officer of the committee has 25 years of banking experience including 24 IT related years as well as continuing education including a BA in Management Information Systems and Network+ and A+ certifications. The purpose of the Information Security Program is to: Identify and analyze cybersecurity risks; Provide the Company with direction on effectively managing such risks; Approve information security plans, policies, and programs; Assess whether the Company's current security programs are effective; and Provide recommendations for corrective action.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber attacks in order to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Great Elm Capital Corp.

ticker: GECC


text: At Sandisk, our management team is charged with managing risk and bringing to our Board of Directors' attention all material risk exposures to our company. Our enterprise risk management ("ERM") process is designed to facilitate the identification, assessment, management, reporting and monitoring of material risks our company may face over the short-term and long-term and promote regular communication with our Board of Directors and its committees regarding these risks. Through our ERM process, we have determined that the compromise, damage or interruption of our technology infrastructure, information systems or products by cybersecurity incidents is a key risk to our company that may have a material negative impact on our business. To help mitigate the potential impact of cybersecurity incidents on our business and protect against cybersecurity threats, we have established organizational structures, procedural measures and response plans that define roles and responsibilities related to cybersecurity risk management.

companyName: Sandisk Corp

ticker: SNDK


text: To test and evaluate the effectiveness of our cybersecurity program, we are subject to annual audits of our program by an outside audit firm who specializes in both information technology and cybersecurity assessments. These assessments include a review of general IT controls, external penetration assessments, internal penetration assessments and security awareness testing of our staff.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: Although our entire Board is actively involved in overseeing risk management, the Audit Committee charter tasks the Audit Committee with providing oversight of management's guidelines and policies to govern the process by which risk assessments and risks are managed, including the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee also discusses with management the processes undertaken to evaluate our systems of disclosure controls and procedures, including those relating to cybersecurity risk management. Our CIO reports quarterly to the Audit Committee and Board regarding cybersecurity matters, which includes emerging cybersecurity threats and the risk landscape, updates on our cybersecurity program and related readiness, resiliency, and response efforts.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, and services. • a security team principally responsible for managing (1) our cybersecurity policies & risk assessment processes, (2) security architecture and engineering, (3) identifying vulnerabilities, managing remediation, and testing of our security controls, and (4) our cybersecurity monitoring & incident response. • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. • managing a cybersecurity awareness and training program that covers employees and contractors who access internal systems. • a cybersecurity incident response plan that includes procedures for responding to various types of cybersecurity incidents and tested through periodic tabletop exercises. • a third-party security risk assessment team, which is involved with identifying, assessing, and controlling risks that occur due to interactions with third parties including vendors and procurement. • restricted physical access to critical areas, servers, and network equipment. • support of our business continuity and disaster response plans.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: The Company's Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and the significance of these threats to our operational integrity and stakeholder confidence. Accordingly, the Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: As of the date of this Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that we will not experience such an event moving forward and if realized, these risks are reasonably likely to materially affect us. Additional information on cybersecurity risks we face can be found in "Risk Factors" in Item 1A of Part I of this report under the heading "System security risks, data protection breaches, cyberattacks, system outages and systems integration issues could disrupt our internal operations or services provided to customers, and could reduce our revenue, increase our expenses, damage our reputation and adversely affect our cash flows and stock price," which should be read in conjunction with the foregoing information.

companyName: HP INC

ticker: HPQ


text: A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training;

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our Information Security department, which is our first line of defense, operates under our Chief Information Security Officer, who manages preventative and detective controls to protect against cybersecurity risks and responds to cyber incidents and data breaches. At least annually, the first line conducts mandatory teammate training on information security and provides ongoing information security education and awareness for teammates, such as online training classes, mock phishing attacks and information security awareness materials. Our cybersecurity risk management program is designed to maintain and challenge our information security defense system, as well as monitor, respond, evaluate, and escalate cyber threats.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: Our Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify our Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Risk Management and Strategy Risk Assessment. We have incorporated policies and procedures aimed at securing and protecting company records and operations. At a minimum, our cybersecurity programs are benchmarked against and aligned to the Center for Internet Security (CIS) Version 8 framework a universally accepted and recognized controls standard published in 2021 to guide periodic risk assessments and ongoing control monitoring activities. External experts are also utilized for cybersecurity evaluations, as needed, to ensure broad and in-depth evaluations of the transforming cybersecurity environment.

companyName: FULL HOUSE RESORTS INC

ticker: FLL


text: The Audit Committee of our Board of Directors oversees our cybersecurity risk management. Our Chief Financial Officer and Director of Information Technology, along with key executives, have roles in governance and facilitating alignment across our organization.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. The Company's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: Our Board is responsible for overseeing our processes for assessing and managing enterprise risk, including with respect to cybersecurity. The Board considers our risk profile when reviewing our annual business plan and incorporates risk assessment into its decisions.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: LNC's Board of Directors is responsible for regular oversight of LNC's overall risk management process. The Board reviews the most significant risks the company faces and the manner in which our executives manage these risks. The Board has also delegated certain of its risk oversight efforts to its committees. Oversight of cybersecurity risk has been delegated to the Audit Committee of the LNC Board of Directors.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: The Cybersecurity function in Autoliv reports to the CISO. The cybersecurity function includes team members in all of the Company's divisions including technical security architects and incident response team members. The core team is supported by the broader organization with security coordinators in each plant and tech center and additional functional security experts as deemed relevant, such as in supply chain management and engineering. The function has the responsibility to operate day-to-day activities (e.g., testing, incident monitoring and response, vulnerability scanning and awareness training) as well as to drive prioritized improvements (as identified through the risk management processes), together with other relevant Autoliv functions and stakeholders. The security operations center ("SOC"), part of the Cybersecurity function, monitors Autoliv for cyber incidents 24/7. A documented incident response process and numerous documented playbooks provide the SOC guidance on how to respond for each type of incident, including categorization and principles for escalation. Incidents are escalated in the organization according to defined criteria to engage a level of authority that is deemed appropriate, such as the Corporate Crisis Management Team if necessary.

companyName: AUTOLIV INC

ticker: ALV


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is primarily responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. We have engaged an external consultant to provide oversight and technical expertise to our ISMS process. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: We seek to identify, manage and reduce the risks and potential vulnerabilities by integrating controls and solutions into information security and technology projects based on severity and priority.

companyName: Coupang, Inc.

ticker: CPNG


text: If we sustain cyber-attacks or other privacy or data security incidents that result in security breaches, we could suffer a loss of sales and increased costs, exposure to significant liability, reputational harm and other negative consequences.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Board comprises our management team and considers cybersecurity risk as part of its risk oversight function.

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material cyber incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors- Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: StratCap Digital Infrastructure REIT, Inc.


text: Our CISO has served in that position since 2018. Our CISO has extensive experience serving in executive and senior IT leadership positions over the past 25 years including serving at Cavium in a succession of information security roles, including Vice President of Business Systems, for eleven years, Vice President of IT Applications at ServiceNow for two years, and overseeing worldwide IT Infrastructure, IT Operations and Information Security at Pinnacle Systems for eight years.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: Measures we have employed to identify potential cybersecurity threats include advanced threat detection systems, such as intrusion detection systems and security information and event management tools. We manage and work to prevent these cybersecurity threats using a variety of strategies, including deploying firewalls and anti-malware tools, implementing access controls and leading security audits. Our incident response plans and monitoring systems also support detection and prevention of cybersecurity threats.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: CFO and representatives from our management committee on cybersecurity, which includes our Chief Business Development Officer and General Counsel, and our outside consultants, who collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks, are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Technical Safeguards: The Company implements technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as assistance from third party experts where necessary.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: In the event of a cybersecurity incident affecting us, we would assess any potential unauthorized attempts to access our IT systems or similar events that may adversely affect the availability or integrity of our IT systems or the security and confidentiality of the data we create, use, transmit, receive, and maintain in our business. Our management team would develop an incident response plan and report to the board of directors on our incident response plan for addressing and mitigating risks associated with such an incident.

companyName: MOBIX LABS, INC

ticker: MOBX


text: We engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide annual independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, vulnerability remediation consulting, security remediation services, patching, and external audit services.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: • Education and Awareness: The Company's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and receive communications on the Company's evolving information security policies and procedures.

companyName: BlackRock Finance, Inc.


text: As a part of our cybersecurity risk management program, our cybersecurity team meets regularly to monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. In the event of a cybersecurity incident, we have a Cyber Incident Response Plan ("CIRP") that governs our immediate response, including detection, escalation, assessment, management, and remediation. As part of the CIRP response, the cybersecurity team will coordinate with external advisors and other senior management as needed. The cybersecurity team routinely tests the CIRP across the organization to validate the procedures for appropriately escalating potentially material cybersecurity risks and incidents.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: After an incident, we would review and document the causes and effects of the incident, evaluate the remediation plan, and consider post-incident improvements. Where applicable, the CTO reports these findings to the Audit Committee and, when appropriate, the Board of Directors.

companyName: VECTOR GROUP LTD


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, investors, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "Operational risks, data security breaches, loss or leakage of data and other interruptions of our information technology systems or those of our third-party service providers may disrupt our business, compromise sensitive information related to our business, or prevent us from accessing critical information, which may result in losses or limit our growth." in "Item 1A – Risk Factors" of this Form 10-K.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Our CIO and CISO routinely inform our Chief Financial Officer and other members of management, as appropriate, about threats, including assessments of threat levels, trends, incidents and related remediation plans, including matters related to the prevention, detection and remediation of any incidents in accordance with our cybersecurity program. We regularly collect data on cybersecurity threats and risk areas and conduct periodic external penetration and other tests to assess the effectiveness of our processes and procedures. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.

companyName: MASTEC INC

ticker: MTZ


text: Systems and Processes To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management program is administered by the Company's legal and internal audit functions, and facilitates the process of identifying and assessing cybersecurity threat risks, as well as monitoring the effectiveness of our risk mitigation efforts. During the year, our senior management periodically identifies the cybersecurity risks facing the Company and reviews our mitigation plans related to these risks. These senior leaders conduct an evaluation of the severity of these identified risks and any changes to this risk level or the Company's mitigation efforts since the prior evaluation. The severity of risks is measured based upon the potential adverse impact that could result, the immediacy of the threat and the availability of mitigating factors, among other elements. Management may consult with outside consultants, such as legal counsel or cybersecurity advisors, in assessing risks and developing mitigation plans. Both the Audit Committee and the full Board regularly receive reports from such outside experts in response to emerging or higher risk areas.

companyName: GLAUKOS Corp

ticker: GKOS


text: The CTOC escalates key operational risk and control issues, as appropriate, to the Global Technology Operating Committee ("GTOC") or its business control committee or to the appropriate LOB and Corporate Control Committees. The GTOC is responsible for the governance of the firmwide Global Technology organization, including oversight of firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.

companyName: Repare Therapeutics Inc.


text: a security team that is principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls and policies, and ( 3) our response to cybersecurity incidents;

companyName: Azenta, Inc.

ticker: AZTA


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity program. Board members receive presentations on cybersecurity topics from our Director of Infrastructure and Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: The Board of Directors has overall oversight responsibility for risk management. Oversight of cybersecurity risks has been delegated to the Audit Committee of the Board of Directors. The Audit Committee also reports material cybersecurity risk to the full Board of Directors.

companyName: HNI CORP

ticker: HNI


text: Our ITSSA, who has significant experience in managing cybersecurity risks is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities, reports relevant information regarding cybersecurity threats and risks to management. Management can then further elevate matters to the full Board of Directors, as necessary or required.

companyName: UNIVERSAL BIOSENSORS INC


text: Furthermore, we maintain a process to evaluate and manage risks associated with third-party service providers. We conduct cybersecurity assessments of our key vendors before engagement, maintain continued monitoring during the engagement, and maintain the ability to discontinue our engagement with a key vendor if their cybersecurity posture fails to meet pre-established standards.

companyName: MEDIFAST INC

ticker: MED


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, operate a bug bounty program to encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.

companyName: Tesla, Inc.

ticker: TSLA


text: The Company maintains a vendor risk management program designed to help identify and manage risks associated with third-party service providers, including a risk-based approach to identifying and monitoring cybersecurity threats presented by certain third-party service providers, with management retaining responsibility for oversight of cybersecurity threats. The Company maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide reporting and disclosure objectives.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including our President and CFO. Our President and CFO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Internal Resources: Our full-time information security team focuses on managing incoming security risks and developing preventative responses to potential future risks, using tools targeted at people, processes, and technology. These efforts include security training for all employees at hire and on an annual basis thereafter, unannounced security testing (particularly on topics such as phishing), and periodic security alert messages for education or urgent security communications.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The Audit and Finance Committee (the "Audit and Finance Committee") of our Board of Directors is responsible for reviewing and monitoring general information technology and cybersecurity matters, including related risks and reporting to the Board its determinations, actions and recommendations related thereto. Our Audit and Finance Committee is composed of independent directors with extensive executive leadership and risk management experience. Our CISO, together with our Chief Information and Digital Officer ("CIDO"), provide quarterly updates to our Audit and Finance Committee regarding the cybersecurity risk landscape, specific risks affecting the Company and solutions to mitigate those risks, and legal and regulatory requirements relating to cybersecurity. These updates assist the Board in performing its oversight and risk management function. In addition, the full Board receives an annual report on cybersecurity directly from the CISO.

companyName: ENTEGRIS INC

ticker: ENTG


text: As noted in Item 1 and Item 1A of Part I of this report, a breach of Astrana's network, hosted service providers, or vendor systems may expose Astrana to a risk of loss or misuse of information, litigation, and potential liability. Therefore, the Company has a team of experienced professionals with expertise in cybersecurity leadership, risk management, incident response, and security operations overseeing Astrana's program. This team is responsible for developing and implementing our cybersecurity strategy, identifying and mitigating risks, and responding to incidents. Astrana utilizes external resources from reputable cybersecurity firms to supplement certain Chief Information Security Officer ("CISO") functions, including risk assessments, strategy, and security, while integrating these activities with Astrana's risk management processes. Astrana assesses third-party cybersecurity controls through cybersecurity questionnaires and includes security and privacy addendums to our contracts, where applicable.

companyName: Astrana Health, Inc.

ticker: ASTH


text: with external service providers to evaluate, enhance, or support our security measures; and incident response plan outlining specific procedures for managing cybersecurity incidents.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Addressing cybersecurity risks requires ongoing monitoring and vigilance, and the Company is making enhancements to its cybersecurity policies, procedures and practices to safeguard sensitive information as well as information from our partners, customers and employees. We employ a risk-based strategy, aligned with the National Institute of Standards and Technology Cybersecurity framework, focused on safeguarding critical assets by implementing controls around access, data, and infrastructure security to protect the confidentiality, integrity, and availability of our data. Maturation and refinement of the Company's cybersecurity risk management strategy and related procedures is a continuous activity to ensure appropriate identification, assessment, and response to risks from cybersecurity threats that may adversely impact our operations. Our employee training and awareness programs are in place to improve cybersecurity awareness throughout the organization and we are committed to educating our employees on best practices for data protection, phishing awareness, and incident response. We also engage with third-party cybersecurity assessors, consultants, and auditors that provide independent assessments of our systems and processes, as well as those of certain third-party service providers, contributing to our efforts to strengthen our cybersecurity posture and enhance our defenses.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: DuPont has dedicated Information Technology security professionals that form the DuPont Cyber Incident Response Team ("DCIRT"). The DCIRT is led by our Chief Information Security Officer ("CISO") and is responsible for the detection and initial assessment of cybersecurity threats and incidents (collectively, "cyber incidents"), whether internal or experienced by significant third-party service providers, using, among other means, third-party software. The DCIRT classifies detected cyber incidents into one of four categories based on potential impact to the functionality of the affected systems, possible or known information involved and recoverability effort. The classification of a cyber incident is designed to allow rapid prioritization, response and escalation. The CISO and the Chief Information Officer ("CIO") are alerted as to any detected cyber incident that is potentially significant. Incidents are documented for regular internal reporting processes including notations and considerations of related attacks.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: In the event of a cybersecurity incident, the Company has a process in place whereby members of the information security group will alert the CISO and the CISO will alert the appropriate levels of management, including an incident assessment team, as well as the legal and finance departments so that the materiality of any such event can be assessed in furtherance of fulfilling any reporting requirements. If warranted, senior management will notify the Audit Committee or the full Board, as appropriate.

companyName: Merck & Co., Inc.

ticker: MRK


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with the CISO, Mr. Eric Brown. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise CISO. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Management's Role in Cybersecurity Risk Management The Company's management team is actively involved in overseeing cybersecurity risk in coordination with the external IT specialist. While day-to-day technical operations are managed externally, internal leadership maintains responsibility for the overall risk management framework, including resource allocation, incident response planning, and strategic integration of cybersecurity within broader business operations. Management evaluates the cybersecurity program's effectiveness periodically and ensures alignment with business continuity and operational risk mitigation objectives.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information and continually align our cybersecurity program with our overall business strategy.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: The Company created an Enterprise Security Council ("ESC") that is comprised of senior IT management (including the CISO and CIO), Internal Audit and Compliance leaders which meet regularly to evaluate potential security risks to the Company and its IA.

companyName: MBIA INC

ticker: MBI


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents could have a material adverse effect on our business, financial condition or results of operations." in Item 1A- Risk Factors.

companyName: Meridian Corp

ticker: MRBK


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information, please see Item 1A- Risk Factors.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, General Counsel, Chief Corporate Affairs Officer and Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement, and govern security policies, standards, and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or in similar roles, which have included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: Personnel with access to certain Company data and information technology assets are required to promptly report known or suspected security incidents. Our incident response process is designed to facilitate the reporting of cybersecurity incidents to management, including the CISO and the Company's designated internal legal counsel, as well as other identified associates from across the Company's business, as applicable.

companyName: Container Store Group, Inc.


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year.

companyName: GXO Logistics, Inc.

ticker: GXO


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations or financial condition, as further described in Item 1A. Risk Factors - "Risks Related to our Business, Operations and Strategy."

companyName: LCI INDUSTRIES

ticker: LCII


text: The Company has integrated our cybersecurity prevention and mitigation processes into our overall risk management system and processes. The Chief Technology Officer of Roto-Rooter and the Chief Technology Officer and Chief Information Officer of VITAS are senior executives, with decades of experience in preventing, assessing and managing cybersecurity threats in the private sector as well as government. Both Roto-Rooter and VITAS employ teams of experienced cybersecurity professionals who report to the respective Chief Technology Officer and Chief Information Officer. Both businesses have security incident response plans, pursuant to which they report on the cybersecurity status of the businesses to the Company's Chief Financial Officer and Controller and Chief Legal Officer both regularly as a matter of course, as well as in the event of any potentially material incident. Additionally, Company senior management reports to the Audit Committee on cybersecurity issues on a regular basis, multiple times a year. The Audit Committee 's reports to the board after these sessions, include the discussions of the cybersecurity risk management process.

companyName: CHEMED CORP

ticker: CHE


text: Our CISO has cybersecurity experience spanning more than 20 years. Prior experience includes serving as the CISO at a mid-size regional financial institution and serving in manager roles at large professional services firms. He holds a degree in Computer Science and Mathematics and maintains several industry certifications.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our cybersecurity risk management program, thus, includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a written cybersecurity incident response plan; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our personnel, incident response personnel, and senior management not less often than once per calendar year; • phishing simulations at regular intervals (not less than quarterly) to all users of the Company's email system; and • a third-party risk management process for service providers, suppliers, and vendors which connect to our IT systems or process data on our behalf. This risk management process is designed to review the cybersecurity protocols, policies and preparedness of any vendor that processes personally identifiable information for the Company or the Company's confidential or proprietary information or otherwise is connected to any Company IT infrastructure before entering an agreement with such vendor and/or at least every 18 months thereafter. Such reviews consist of reviewing SOC2 Type II reports for vendors which maintain them or, for those that don't, a review of the vendor's responses to a detailed questionnaire. Upon a review of such responses, the Company's cybersecurity team may propose remediation measures (which are set forth in the contractual obligations to be agreed upon by the vendor).

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, supply chain resources (including warehousing and cold storage) and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes, for example, completion of a cybersecurity questionnaire, internal reviews of vendor security programs and assessments, security assessment calls with vendor personnel and imposition of information security obligations in our vendor contracts. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Vital Farms, Inc.

ticker: VITL


text: We believe that the conduct of our employees is critical to the success of our information security. We keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes training intended to prevent the success of cyberattacks. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: ERP software is made accessible, controlled and monitored through an extensive list of policies and procedures. These include protocols dictating acceptable use, management of confidential data, application monitoring, secure access policies and application access strategies.

companyName: AIRWA INC.

ticker: YYAI


text: Risk Assessment: The Company generally evaluates risks, including cybersecurity risks, based on probability, impact and proximity. As part of its program, the Company conducts formal cybersecurity risk assessment exercises at least bi-annually. The Company has documented processes and protocols in order to delineate unacceptable levels of risk and assess such risks based on a number of factors.

companyName: Vertiv Holdings Co

ticker: VRT


text: Third parties also play a role in our cybersecurity. We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks. Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to alignment with industry standards such as, for example, the Payment Card Industry Data Security Standards.

companyName: BEST BUY CO INC

ticker: BBY


text: The Audit Committee of the Board of Directors is charged with oversight of cybersecurity matters and receives reports from the IT manager and Chief Executive Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. In accordance with our Cyber Incident Response Plan, the Audit Committee will be promptly informed by management of cybersecurity incidents with the potential to materially adversely affect the Company or its information systems and is regularly updated about incidents with lesser impact potential. At least annually, the Board reviews and discusses the Company's technology strategy in combination with the Company's strategic objectives with executive management.

companyName: Future FinTech Group Inc.

ticker: FTFT


text: Our cybersecurity program is structured to identify, assess, and mitigate risks through continuous monitoring, proactive threat intelligence, and a multi-layered defense strategy. We implement security controls, tools, and incident response procedures to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including cybersecurity incidents. We emphasize fraud prevention, data protection, and securing our core platforms, while also prioritizing zero trust architecture, third-party risk management, immutable backups, training our staff and others who may have access to our data and systems, and improvement of our security personnel.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: The audit committee of Sionna's board of directors has ultimate oversight over cybersecurity risk. Our IT Leadership presents to the audit committee periodically regarding cybersecurity matters, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable. The Chief Financial Officer and the General Counsel are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents. The audit committee will update the board of directors on matters related to cybersecurity as needed.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: We design and assess our policies and procedures based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF framework). This does not imply that we follow or meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. For example, we periodically perform independent third-party security audits and assess potential risks.

companyName: Niagen Bioscience, Inc.

ticker: NAGE


text: Certain members of our management team are responsible for hiring appropriate consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: MERRIMACK PHARMACEUTICALS INC


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management advisors, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Schrodinger, Inc.

ticker: SDGR


text: As part of our cybersecurity risk management, we have established controls and procedures to guide the Company through an active threat or incident to the recovery of normal business, following industry-standard data protection standards. The controls and procedures provide for the identification, notification, escalation, communication, and remediation of cybersecurity incidents to management, including where appropriate the board of directors, so that decisions regarding the public disclosure and reporting of such incidents can be made in a timely manner. We maintain an Executive Cyber Response Team composed of senior leaders across various functions, including our CIO, General Counsel and Chief Accounting Officer. The Executive Cyber Response Team is trained and experienced in managing cybersecurity incidents and meets regularly to practice and refine our processes for incident response, management and escalation through tabletop exercises simulating cyberattacks administered by a legal advisor with extensive experience in cyber investigations, cyber threats and cyber-enabled frauds. The results of such exercises are then reported to management and our board of directors. The third-party legal advisor also assesses and advises on our overall cybersecurity program, reports to our board of directors on a periodic basis and is engaged to provide support in the event an attack or other intrusion were to be successful.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. In the event of a potential cybersecurity incident, the Company's MSP has the capability to take a number of immediate steps to isolate the potential threat.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: Our companywide cybersecurity policy sets the framework for our approach to cybersecurity. Each business unit and our corporate headquarters designates individuals with appropriate qualifications and experience to be responsible for addressing cybersecurity matters, including assessing, identifying and managing risks from cybersecurity threats, with a direct reporting line to senior management. Under our approach to cybersecurity, each business unit designs and operates its own information and cybersecurity program tailored to its market, customer requirements, regulatory requirements and threats. Our cybersecurity policy and procedures are designed to ensure senior management receives timely and adequate information regarding cybersecurity matters, including threats and incident response, as appropriate to the matter. Our policies and procedures are also designed to oversee and identify material cybersecurity risks related to third-party vendors and service providers.

companyName: GULF RESOURCES, INC.

ticker: GURE


text: The company has a robust information security training and compliance program for all new and existing employees. Training is provided at least annually, with a formal communication cadence of additional components of training being provided throughout the year. Employee cybersecurity proficiency is assessed quarterly, with supplementary training programs tailored to individual needs based on these evaluations. The company has not experienced a material cybersecurity or information security breach in the last three years.

companyName: MIDDLEBY Corp

ticker: MIDD


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is intended to make cybersecurity considerations an integral part of our decision-making processes. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our security team, led by our CTO. Our CTO has over 14 years of experience in engineering and development, including leadership roles. Other members of our security team collectively have over 50 years of experience in information security.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Additionally, on a quarterly basis, our Audit Committee receives reports from the Chief Information Officer, Chief Information Security Officer, and other members of management. As part of its annual assessment, the Audit Committee evaluates significant risks related to our business including cybersecurity risks, and provides such information to our Board of Directors. Our Internal Audit Group also reviews our cybersecurity governance and controls annually.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Part I, Item 1A, "Risk Factors—Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure of an information technology or operational technology system owned or operated by us or a third party, could adversely affect us."

companyName: Kenvue Inc.

ticker: KVUE


text: Our CISO is responsible for our Information Security Program and our information security leaders report directly to our CISO. We also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management, our CISO and information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our Information Security strategy and program, and daily Security Operations.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Our Chief Executive Officer and Senior Vice President of Finance are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Senior Vice President of Finance have assistance from consultants.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: The Privacy team, which is part of the compliance function, has a dedicated incident response team responsible for assessing, identifying and managing risks from cybersecurity threats involving personal information. The team follows documented processes for investigation, research, assessment, notification, regulatory reporting and, if necessary, escalation to management, and such processes have been integrated into the Information Security incident response program. The Information Security team works closely with the Privacy team to respond to any cybersecurity incidents involving personal information. The Privacy team engages third parties to assist with incident assessment and notification.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: cybersecurity awareness training for our employees, incident response personnel, and senior management. This includes mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a material cybersecurity incident (or series of related cybersecurity incidents), our outsourced security team has a written incident response plan outlining how to address cybersecurity events that occur. We have assigned a team comprised of finance and technology personnel to review the plan annually to serve as a framework for the execution of responsibilities across businesses and operational roles. The incident response plan is designed to help us coordinate actions to prepare for, detect, respond to and recover from cybersecurity incidents, and includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to assess the need for disclosure, comply with applicable legal obligations and mitigate the impact to our brand and reputation and on impacted parties. In addition to the cybersecurity incident response plan, our outsourced team conducts tabletop exercises to enhance our incident response preparedness. They also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Such processes include conducting due diligence and risk assessment of our current and potential vendors that examine such vendor's cybersecurity protocols and adherence to applicable regulations.

companyName: TREVENA INC


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have further developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.

companyName: Altair Engineering Inc.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures have been independently audited and assessed against some of the leading international cybersecurity standards and programs.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management as necessary regarding cybersecurity.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results." in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: We do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition during the period covered by this filing. For additional information on our cybersecurity risks, please read Item 1A. Risk Factors - A breakdown or breach of our information systems could subject us to liability or interrupt the operation of our business, included in this report.

companyName: BIOGEN INC.

ticker: BIIB


text: Comerica engages information technology risk management employees with experience and expertise in cybersecurity. The organization consists of professionals in identity and access management, cyber defense operations, security engineering and information technology governance, risk and compliance. An Executive Vice President/ Chief Information Security Officer (with over 25 years' experience in cybersecurity risk management) and a Chief Information Officer (with over 27 years' experience in technology risk management) lead this team. Each reports directly to the Senior Executive Vice President / Chief Operating Officer, who reports directly to Comerica's Chief Executive Officer and the Board of Directors. In addition, Comerica engages third parties from time to time to assess, manage and respond to cybersecurity risks through risk assessment, penetration testing, incident response, threat intelligence, education, and managed security services.

companyName: COMERICA INC

ticker: CMA


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party services providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Our cybersecurity risk management program is expected to include: risk assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader enterprise IT environment;

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Company management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: The Senior Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Senior Director of IT has served in various roles in information technology and information security for over 20 years. The Senior Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.

companyName: Scilex Holding Co

ticker: SCLX


text: Our information security team, including our system engineering department leader who manages our information technology, is responsible for accessing and managing cybersecurity operations and incident response, reports cybersecurity incidents to management and, if the incidents are material, our audit committee. The members of our information security team each have over 10 years of experience and extensive knowledge in managing cybersecurity programs.

companyName: SemiLEDs Corp

ticker: LEDS


text: Board and Committee Oversight Our Board has oversight responsibility for our overall enterprise risk management and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee oversees Lucid's policies and practices with respect to risk assessment and risk management, including discussing with management (i) Lucid's major financial, cybersecurity, privacy and other information technology risk exposures; (ii) the steps that have been taken to monitor and control such exposures; and (iii) any material cybersecurity threats or incidents. The Audit Committee and the Board receive regular reporting from Lucid's management, including the leadership of our enterprise IT security and product cybersecurity departments ("Cybersecurity Leaders") on the status of our cybersecurity program and ad hoc reporting on material cybersecurity threats and incidents.

companyName: Lucid Group, Inc.

ticker: LCID


text: The Company has implemented a Cybersecurity Incident Response Plan (the "IR Plan") and framework to appropriately detect, contain and respond to cybersecurity incidents. The IR Plan identifies protocols for incident classification, the use of third-party service providers where applicable, processes for notification and internal escalation of information to senior management and the Audit Committee, and processes for materiality review. The IR Plan is reviewed and updated, as necessary, under the leadership of the Company's CISO. Additionally, the Company maintains processes to assess the risks associated with third parties that store, transmit, or process sensitive Company data.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: Management's Role Managing Risk Our risk management committee is comprised of a cross section of the Company's management team. The risk management committee has identified cybersecurity as a key risk to the Company's operations and established a cybersecurity sub-committee, which is comprised of members of the risk management committee and other personnel, to focus on this key risk.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats The Cybersecurity Incident Response Team ("CIRT") and/or the Crisis Management Team ("CMT") utilize a Cybersecurity Incident Response Plan (the "CIRP") and the Playbook to: (1) prepare for and protect against Incidents; (2) detect and analyze Incidents; and (3) contain, eradicate and appropriately report on cybersecurity events. In the event of an Incident, the CIRP provides a framework to coordinate the response. The CIRP and Playbook also address escalation protocols to senior management with respect to disclosure determinations related to an Incident and provides for Executive Team briefings as appropriate. If the CIRT's initial investigation of the facts of an Incident indicates the need for escalation for potential disclosure, the CMT will utilize the process in the Playbook and the Cyber Disclosure Procedure will be utilized.

companyName: ROBERT HALF INC.

ticker: RHI


text: The Company's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but the Company cannot provide assurance that it will not be materially affected in the future by cybersecurity risks, threats or incidents. See Item 1A under the caption "Increased cybersecurity threats and more sophisticated computer crime pose a risk to our systems, networks, operations, products and services." for additional information on cybersecurity risks applicable to the Company.

companyName: OSHKOSH CORP

ticker: OSK


text: Our Chief Security Officer supervises efforts to prevent, detect, mitigation and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment. Our Chief Security Officer is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for leading our overall cybersecurity risks management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Security Officer has significant global experience in managing and leading IT and cybersecurity teams and holds cybersecurity certifications from leading cybersecurity training and research institutes.

companyName: PARSONS CORP

ticker: PSN


text: Our information technology may be subject to cyber-attacks, security breaches or computer hacking. Hackers and data thieves are increasingly sophisticated and operate large-scale and complex automated attacks. Experienced computer programmers and hackers may be able to penetrate our security controls and misappropriate or compromise sensitive personal, proprietary or confidential information, create system disruptions or cause shutdowns. They also may be able to develop and deploy malicious software programs that attack our systems or otherwise exploit any security vulnerabilities. Our systems and the data stored on those systems may also be vulnerable to security incidents or security attacks, acts of vandalism or theft, coordinated attacks by activist entities, misplaced or lost data, human errors, or other similar events that could negatively affect our systems and the data stored on those systems, and the data of our business partners. Further, third parties, such as hosted solution providers, which provide services to the Company, could also be a source of security risk in the event of a failure of their own security systems and infrastructure.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct thorough due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.

companyName: ARTIVION, INC.

ticker: AORT


text: For a discussion of cybersecurity risks affecting our business, see Item 1A - Risk Factors - Risks Related to Our Information Technology Systems.

companyName: Ingredion Inc

ticker: INGR