text: We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii) protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our board of directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Administrative Officer, or CAO, and Vice President of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our CAO reports directly to our Chief Executive Officer and our Vice President of Information Technology reports directly to our CAO and has over 15 years of experience in cybersecurity.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: The Risk, Compliance and Planning Committee of our Board of Directors provides oversight of the information security program including cybersecurity and is chaired by an independent director. Cybersecurity metrics are reported to the committee quarterly. Additionally, management has established an Information Technology Executive Steering Committee focused on, technology impact, and an Enterprise Risk Management Committee focused on business and risk impact, both consisting of executives and department leaders across multiple domains. These committees generally meet quarterly and more frequently when warranted. The information security department holds a monthly security meeting with the managers from the information technology department to discuss significant security incidents and status of the threat landscape. The Information Security Officer reports significant cybersecurity or privacy incidents and the state of the information security program to the Risk, Compliance and Planning Committee of the board on a quarterly basis. The Risk, Compliance and Planning Committee of the Board of Directors provide a report of activities to the full board at each quarterly board meeting.

companyName: HANMI FINANCIAL CORP

ticker: HAFC

secItem: Item 1C


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies; and alerts and reports produced by security tools deployed in the IT environment. In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.

companyName: FuboTV Inc.

ticker: FUBO


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents, depending on the circumstances, to our senior management team and Audit Committee of the Board of Directors. The Audit Committee of the Board of Directors receives reports from our Senior Vice President, Information Technology concerning our significant cybersecurity threats and risks (including certain cybersecurity threats) and the processes we have implemented that are designed to address them.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Mobile Infrastructure Corp

ticker: BEEP


text: Our Head of Information Technology for Latin America, who oversees Cybersecurity, has 25 years of experience in strategic IT leadership and global project management.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents, and there can be no guarantee that future incidents will not have a material adverse effect on its business. See "Risk Factors - Breaches in security, whether cyber or physical, and related disruptions and/or our inability to prevent or respond to such breaches, could diminish our ability to generate revenues or contain costs, compromise our assets, and negatively impact our business in other ways" for more information on the Company's cybersecurity risks.

companyName: ULTRALIFE CORP

ticker: ULBI


text: Each of these committees provides summary reports on their activities, which the CISO communicates as appropriate to the Audit Committee.

companyName: Shutterstock, Inc.

ticker: SSTK


text: In fiscal year 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we face potential cybersecurity threats that, if realized, would materially affect us. These threats include but are not limited to ransomware and malware attacks, and compromised business email and other social engineering threats. Our suppliers, customers, contractors and business partners also face similar cybersecurity risks, which could have an adverse impact on our business.

companyName: Sino Green Land Corp.

ticker: SGLA


text: We maintain a continuous monitoring strategy that utilizes advanced tools and technologies to oversee our network infrastructure and digital assets. This includes data loss prevention controls, system log reviews and unusual activities that could indicate a potential security breach. Automated alert systems deployed as part of our monitoring controls are designed to enable rapid identification and escalation of suspicious activities. These systems are configured to detect a range of cyber threats, from malware infections to unauthorized access attempts.

companyName: EVgo Inc.

ticker: EVGO


text: In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: Fold Holdings, Inc.

ticker: FLD


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity service providers, assessors, advisors and consultants, in evaluating and testing our cybersecurity program. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategies and processes are aligned to industry best practices. Our collaboration with these third parties includes threat assessments and consultation on security improvements, program maturity and regulatory compliance. Additionally, we conduct multiple penetration tests annually and retain an external consultant to periodically evaluate the overall state of our program.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Our Company has established robust policies and processes governing the assessment, response, and notifications associated with cybersecurity incidents. These protocols ensure a systematic and coordinated approach to incident management, with collaboration among engineering, legal, and senior leadership to oversee compliance with legal and regulatory requirements and have clear mechanisms in place for escalating notifications to our CEO and the Board based on the nature and severity of each incident.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: We utilize external information technology consultants to provide technical support for our systems and to advise on security matters. Risks associated with third-party service providers who have access to our data are evaluated during the vendor selection process.

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: Cybersecurity forms a critical component of the services we provide to our customers. We collect and utilize many different types of information, including financial, medical, human resources, and other personal information. Federal and state laws and regulations, contractual obligations, and national and international industry standards, impose obligations on us to protect the confidentiality, integrity, and availability of information relating to employees, clients, vendors, patients, and citizens. We maintain an Information Security Office (ISO), whose mission is to protect the confidentiality, integrity, and availability of data through administrative, technical, and physical safeguards.

companyName: MAXIMUS, INC.

ticker: MMS


text: Related to Cybersecurity Risks Our board of directors has oversight over cybersecurity risks. Our management provides periodic presentations to the board of directors on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable. The management provides updates regarding our cybersecurity program to the board of directors when material.

companyName: Amesite Inc.

ticker: AMST


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures. The CISO has over 30 years of IT and IT security experience in various organizations with 14 years in the banking industry.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer, Director of Information Security, Chief Financial Officer and Chief Legal Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, Certified Professional Hacker. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee of our Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: We have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates several components, including employee training, periodic penetration tests, and multifactor authentications.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Effective July 26, 2023, the SEC finalized rules requiring registrants to disclose material cybersecurity incidents. Per the ruling, any cybersecurity incident deemed to be material shall be disclosed within four business days of materiality determination. The determination of materiality related to cybersecurity incidents is subjective, however, the Company has implemented materiality consideration in its formal process.

companyName: PROASSURANCE CORP

ticker: PRA


text: The Company's CISO has served in various roles in information technology and information security for over twenty years, including serving as a Cyberspace Operations Officer in the United States Air Force Reserves and instructing for the SANS Technology Institute. The Company's CISO holds an undergraduate degree in Business Administration and has attained the professional certification of Certified Information Systems Security Professional ("CISSP") and numerous GIAC certifications. The Company's CRO has over a 25-year career in the banking industry and is currently serving as Senior Executive Vice President and Chief Risk Officer of Stellar Bank and Chief Risk Officer of Stellar Bancorp, Inc. Previously, the CRO has held the positions of President and Chief Risk Officer at Allegiance Bank and Executive Vice President and Chief Risk Officer at Allegiance. The Company's CRO's banking career as an executive started at Independence Bank in 2002 as Senior Credit Officer and eventually was promoted to President in 2009. Between 2010 and 2013, the CRO also served as CEO of Independence Bank until joining Allegiance Bank following a merger. The Company's CRO has since assumed the roles of Regional President, Deputy Chief Credit Officer, and Chief Administration Officer at Allegiance Bank. The CRO holds an MBA from the University of Houston and a Bachelor of Arts in Finance & Marketing from the same institution.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Risk Management and Strategy is committed to ensuring the highest standards of cybersecurity to protect our systems, networks, and data from cyber threats. We recognize the critical importance of safeguarding sensitive information and maintaining the trust of our customers, partners, and stakeholders. cybersecurity strategy is built on a foundation of proactive risk management, continuous monitoring, and adherence to industry best practices. We employ a multi-layered approach which leverages cutting-edge technologies to defend against evolving cyber threats.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: During the reporting period, we were not impacted by any cybersecurity incidents that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: RADIAN GROUP INC

ticker: RDN


text: We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.

companyName: Laser Photonics Corp

ticker: LASE


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."

companyName: COCA COLA CO

ticker: KO


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Via Renewables, Inc.

ticker: VIASP


text: To date, we do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected our business strategy, results of operations, or financial condition. However, the sophistication of cybersecurity threats continues to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity incidents and protect our systems and information may not successfully protect against future cybersecurity incidents, which could materially affect our business strategy, results of operations, or financial condition. For additional information on certain risks associated with cybersecurity, refer to the risk factors related to cybersecurity and information technology systems in "Part I, Item 1A. Risk Factors."

companyName: TE Connectivity plc

ticker: TEL


text: Further, to communicate our system health, performance, metrics, and roadmap, the Information Technology team delivers a quarterly update to the Audit Committee, as well as the Cybersecurity Governance Committee and Cybersecurity Risk Committee, to discuss cybersecurity matters such as the effectiveness of our cybersecurity strategy and ensuring alignment with our business objectives. A Cybersecurity Dashboard is used to share metrics and matters needing Board attention in Audit Committee meetings. The Cybersecurity Dashboard also includes commentaries on risk exposure and materiality, if any, as they relate to cybersecurity.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a separate annual in-person meeting with the Company's Chief Information Officer (CIO) and subsequently provides an update to the Board. The Company's CIO also attends a second annual meeting directly with the full Board of Directors. Beginning in 2025, in addition to these annual meetings, the CIO or the Sr. Vice President of Engineering & Technology is scheduled to meet with the Audit Committee such that the Board and the Committee receive updates on at least a quarterly basis. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors may be convened.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: The Company's Cybersecurity System includes administrative, technical, and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of the Company's and its customers' information. This includes protecting against known and evolving threats to the security of the Company's systems and information, and against unauthorized access, compromise, or loss of data. The Cybersecurity System is managed centrally, so the same security controls, policies and procedures are implemented across the organization.

companyName: OneMeta Inc.

ticker: ONEI


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third -party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: Based on the information available as of the date of this Annual Report, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "Risks Related that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, as well as the overall size of the Board, the Board believes it is useful and effective for the entire Board to maintain direct oversight over cybersecurity matters. We have implemented processes that will include regular updates to the Board from our Chief Executive Officer and Chief Financial Officer for its review and feedback regarding cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and also discusses any significant cyber incidents, including recent incidents at other companies and the emerging threat landscape.

companyName: NEPHROS INC

ticker: NEPH


text: Our Cybersecurity Executive Council ("Council"), which is led by the Chief Information Officer ("CIO") and includes our Chief Information Security Officer ("CISO"), Chief Operating Officer ("COO"), General Counsel ("GC"), Chief Compliance Officer ("CCO"), SVP of Research & Development, Senior Director of Engineering, and AVP of Engineering, oversees NetScout's cybersecurity program, including strategy, threats, risks, and mitigations. The CISO and Senior Director of Engineering, with guidance from the Council, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and NetScout's risk profile using various methods such as implementing manual and automated tools, subscribing to services that identify cybersecurity threats, analyzing reports of certain threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments to identify vulnerabilities, and engaging in tabletop incident response exercises.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: These processes are managed and monitored by a dedicated Cybersecurity and Infrastructure team, which is led by our Chief Information Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and annual and ongoing risk assessments. We engage third parties to perform monitoring and regular penetration testing. We have adopted an Incident Response Policy that applies in the event of a cybersecurity threat or incident that follows the National Institute of Standards and Technology framework. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: We are subject to cyber incidents and will continue to be exposed to cyber incidents in the normal course of our business. Incident response plans, procedures and processes are in place to address any cyber incidents, events or occurrences. Along with our third-party hosting platform, we periodically test preparedness ensuring and appropriate response is designed for immediate application. Although, such risks have not materially affected or are reasonably unlikely to materially affect us, these risks could affect our business strategy, including financial condition, results of operations, or cash flows. The extensive approach we take to cybersecurity may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A – Risk Factors for a discussion of cybersecurity risks.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: The Risk Committee of our Board of Directors, in coordination with our management risk committee, has primary responsibility for overseeing cybersecurity, information technology and information security systems, processes, policies and risk management and the effectiveness of security controls. At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment. The Risk Committee also reviews the Chief Compliance Officer's quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report. Management also keeps the Risk Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.

companyName: Enact Holdings, Inc.

ticker: ACT


text: Our Bank Operational Risk Oversight Committee (OROC) (a management level committee, consisting of members of our senior leadership) and its subcommittee, the Technology Risk Sub-Committee (TRSC) (consisting of representatives across the Bank, including from the Risk Management and Information Technology groups), are responsible for reviewing our cybersecurity risk management program's efforts and activities to track the progress of the program's support of the Bank's objectives. TRSC (and to the extent necessary, OROC) receives regular reporting from our CISO including information security metrics, material technology changes and cybersecurity threats being monitored. The Bank's Executive Team is the primary management committee for the Bank across all functions and receives reports from the OROC, Technology Risk Sub-Committee, and the CISO as appropriate on matters impacting cybersecurity risks.

companyName: Federal Home Loan Bank of Chicago


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation, and immediately informing the CISO, whom leads the IT security team, upon the occurrence of any material event. The processes used to assess the risk level includes preparing a monthly cyber scorecard, regularly collecting data on cybersecurity threats and risk areas, and conducting an annual risk assessment. To assure risks are reduced and maintained, we conduct periodic external penetration tests, red team testing, and maturity testing to assess our processes and procedures and the threat landscape. We regularly test defenses by performing simulations and drills at both a technical level (including penetration tests) and by reviewing our operational policies and procedures with third-party experts. We view cybersecurity as a shared responsibility throughout the Company, and we periodically perform simulations and tabletop exercises at technical and management levels and incorporate external resources and advisors as needed. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity online training. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We utilize our Internal Audit team to assess the design and operating effectiveness of our internal controls, including those that relate to our IT security environment. Further, we maintain various cyber insurance policies and believe we are adequately covered in the event we experience a cybersecurity breach. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls ("SOC") 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Sinclair, Inc.

ticker: SBGI


text: Our management team, including our chief financial officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel, our external information technology support, and our retained external cybersecurity consultants. Our information technology department has over 20 years of experience developing and implementing computer infrastructure, including cybersecurity and audit compliance. We seek to use the latest security technologies from leading vendors to help secure our network and to regularly monitor and assess alerts and threat levels. The information technology department possesses various industry certifications and continuously refreshes skills through relevant training.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We have adopted an Incident Response Management Procedure (the Procedure) that outlines the legal and governance processes for identifying and managing material risks to privacy and security. An incident response team is responsible for carrying out the Procedure and is led by our information & technology (I&T) department, and includes members from our legal and compliance, privacy, investor relations, finance, and quality departments. In addition, our enterprise information security program describes our capabilities and processes for the preparation, detection, analysis, containment, recovery, and reporting of incidents. We also manage and maintain business continuity and disaster recovery capabilities to help ensure the availability of business-critical technology resources during adverse conditions.

companyName: Deciphera Pharmaceuticals, Inc.


text: The director of cybersecurity (CISO) has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity (CISO) has been involved in designing and evolving the Companies' cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.

companyName: VIRGINIA ELECTRIC & POWER CO


text: Role of the Board of Directors Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Audit and Finance Committee of our Board of Directors has primary responsibility for and oversight over cybersecurity threats and our information security management program and considers specific risks, including, for example, risk associated with our strategic plan and business operations. The Audit and Finance Committee receives regular reports from our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering, on, among other things, material cybersecurity threat risks or incidents and developments, assessments of our security program and overall security posture, our incident response plan, and initiatives to strengthen our information security systems and mitigate cybersecurity risks. The Audit and Finance Committee, including Rashmi Kumar, provides insights and guidance to management on cybersecurity related matters. Ms. Kumar, who currently serves as Senior Vice President, Chief Information Officer, of Medtronic plc, is a seasoned technology leader with extensive experience in cybersecurity and information technology matters. Management, along with the chair of the Audit and Finance Committee and Ms. Kumar, regularly report to the Board of Directors on cybersecurity risks and other related matters reviewed by the Audit and Finance Committee.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO. Reporting to our CTO is the CISO, the individual who provides day-to-day oversight of our cybersecurity program. Our CISO is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity threats. Our CISO oversees a team that regularly communicates with respect to the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO's team consists of individuals that have knowledge, skills and expertise to respond to a cybersecurity incident. Our CISO coordinates with the CTO, who coordinates with the Company's and our subsidiaries' executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company's technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.

companyName: NewtekOne, Inc.

ticker: NEWT


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: CervoMed Inc.

ticker: CRVO


text: We have a global incident response policy that is shared with key stakeholders and outlines our classification, escalation, investigation, reporting, and overall response procedures depending on the classification and severity of incidents. Local IT teams must also create a local incident response plan and playbooks for addressing various types of incidents and handling escalations and reporting obligations locally. Further, we engage external forensic investigations as necessary to augment our incident reporting process if deemed critical and/or necessary for prompt response to security incidents which may require a higher technical level of forensics and/or resources to quickly assess and respond to certain incidents.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Our information security policies and procedures are required to be reviewed on a regular basis have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations; however, there can be no guarantee that we will not experience such an incident in the future. For a description of the risks from cybersecurity threats that may materially affect our Company, see "Item 1A. – Risk Factors" included elsewhere this Annual Report on Form 10-K, including "Our data and information systems and network infrastructure may be subject to hacking or other cybersecurity threats. If our security measures are breached and an unauthorized party obtains access to our proprietary business information, our information systems may be perceived as being insecure, which could harm our business and reputation and our proprietary business information could be misappropriated, which could have an adverse effect on our business and results of operations."

companyName: Odysight.ai Inc.

ticker: ODYS


text: Primary responsibility for assessing, monitoring, and managing the Company's cybersecurity risks rests with the CISO. The CISO has obtained cybersecurity credentials for the role, possesses expertise in the technical domain, and receives assistance from industry experts in decision-making. The CISO oversees the information security policies and data protection programs, implementation of protective and detective tools, tests the Company's compliance with standards, and remediates known risks. These initiatives include phishing simulations, semi-annual cybersecurity education to employees, and competency assessments. Additionally, the Company conducts table-top incident response practices and other measures to enhance overall cybersecurity preparedness. These efforts underscore the organization's commitment to addressing a wide range of potential threats and cybersecurity challenges.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: We have implemented and maintain various information security processes designed to assess, identify and manage material risks from cybersecurity threats to our critical systems and information. Such processes are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and has historically been included as part of compliance reports provided to our audit committee.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: Our Chief Technology Officer is primarily responsible for managing material risks from cybersecurity threats, and is supported by our Vice President of Information Technology, Operations and Security, along with a dedicated team of internal cybersecurity specialists. The Information Technology leaders participate in periodic training and education on cybersecurity related topics, while members of our internal security team also maintain industry certifications, such as Certified Information Systems Security Professional (CISSP). Our current Chief Technology Officer has more than 35 years of experience in information technology. Our Chief Technology Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the internal team. We also engage specialized cybersecurity consultants and leverage third-party expertise to bolster our cybersecurity defenses. Our enterprise risk management program is designed to identify, prioritize and assess a broad range of risks, including risks from cybersecurity threats, that may affect our ability to execute our corporate strategy and fulfill our business objectives. Our Vice President of Risk Management oversees this program and works with our information technology leadership team to formulate plans to mitigate the effects of risks from cybersecurity threats. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: While we have experienced threats to our data and systems, to date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. That said, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition in the future. For further information regarding cybersecurity risks, see Item 1A, "Risk Factors" in this Annual Report.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Third-party service providers must meet baseline security requirements before they connect to our systems or manage sensitive information. They are evaluated based on risk, which is based on financial, operational, legal/regulatory, capacity, cybersecurity posture, and reputational impact. Additionally, high risk third-party service providers are continuously monitored for security health and active threats.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: The audit committee of the board of directors receives annual reports from our Senior Director of Information Technology/Information Security concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee of the board of directors also receives and has access to various presentations related to cybersecurity threats, risk and mitigation.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Securing the information of our customers, employees, contractors, and third party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. Accordingly, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management to the Audit Committee. We also maintain information security risk insurance coverage.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: We recognize cybersecurity as an enterprise risk, and accordingly cybersecurity risk has been integrated into our overall risk management process. As part of our overall enterprise risk management process, we have established our management-level Risk Committee, composed of our Chief Information Officer, Chief Legal Officer and Chief Financial Officer, among others, which assesses overall risks to the Company based on input from our other business leaders. We have also implemented an incident response process that is overseen by our Senior Director of Cybersecurity and supported by a multi-level incident response process led by our cybersecurity team. This is a documented framework that addresses our processes to assess, identify and manage material risks from cybersecurity threats and incidents, which are prioritized for response and remediation efforts. Our incident response process includes analysis of the impact of a cybersecurity threat or incident for materiality to ensure proper reporting. Our incident response process is continually enhanced and validated through tabletop exercises and engagements with third-party partners.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Risk Management Committee of the Board (the "Risk Management Committee"), which regularly interacts with the Company's ERM function, other members of management and relevant management committees and councils, including management's Cybersecurity Council.

companyName: Emeren Group Ltd


text: JFG's cybersecurity program is periodically assessed by JFG's Internal Audit Department. The results of these audits are reported to the Audit Committee of the JFG Board. Any resulting findings and associated actions to address issues are tracked and managed to completion. In addition, JFG's IT Risk team provides Key Risk Indicators ("KRIs") monthly to JFG's Operational Risk Committee whose members include the CIO, CRO, Head of Internal Audit and the CISO and their representatives. The monthly presentation includes updates on key security incidents and trending of cybersecurity KRIs.

companyName: Senior Credit Investments, LLC


text: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, assist with our PCI-DSS compliance assessments, assess our systems' alignment with the NIST Cybersecurity Framework, ensuring adherence to ISO audits.

companyName: CONDUENT Inc

ticker: CNDT


text: severity classification according to the Cybersecurity Incident Response Standard or that otherwise necessitates regulatory disclosure because of its materiality, will be communicated by the CIRT to the Board within specified timeframes. All cybersecurity incidents, will be evaluated by our CIRT to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT Team may utilize the services of third-party consultants. Third-party consultants may be engaged to assist with the identification of the source of any cybersecurity incidents, remediation and recovery from such incident, and the refinement of cybersecurity controls to avert similar future cybersecurity threats and incidents.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and SVP Engineering, General Counsel and Head of Global Affairs, and Chief Privacy Officer, as appropriate. In addition, our incident response plan includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Grindr Inc.

ticker: GRND


text: Our CISO has over 25 years of technology experience, with over 15 years of Information Security management experience. He was appointed as our CISO in March 2021, after serving as Director Security for approximately 2 years. Prior to that, he worked at GEP Worldwide as a Director of Security and Infrastructure Technology Management for approximately two years. Our CISO is certified for Certified Information Systems Security Professional (CISSP), and Certified Cloud Security Professional (CCSP).

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: On July 26, 2023, the SEC adopted rules requiring registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance. The final rules became effective 30 days following publication of the adopting release in the Federal Register. The Form 10-K disclosures are due beginning with annual reports for fiscal years ending on or after December 15, 2023.

companyName: Breeze Holdings Acquisition Corp.


text: Our cybersecurity processes are designed to identify and address cybersecurity risks associated with our use of third-party technologies and service providers.

companyName: Informatica Inc.

ticker: INFA


text: The Chief Technology Officer, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.

companyName: Champion Homes, Inc.

ticker: SKY


text: Our Board of Directors considers cybersecurity risk to be a critical part of its risk oversight function and has delegated to the Risk & Technology Committee primary oversight of cybersecurity and other information technology risks. The Audit Committee also reviews cybersecurity matters are part of its oversight of major financial risk exposures. The Risk & Technology Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Effects and Impacts of Cybersecurity Risks As announced on October 28, 2023, we identified a cybersecurity incident impacting certain internal operations and information technology systems which adversely affected our ability to ship orders in the first quarter of fiscal 2024. All of our facilities were operational by mid-December 2023 and were returned to normalized operations. We incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024. Additionally, we have invested and intend to continue to invest in strengthening our systems, cybersecurity training, policies, programs, response plans and other similar measures. As of the date of this report, except as set forth herein, we are not aware of any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition. See "Item 1A. RISK FACTORS" - "If we do not successfully maintain our information and technology networks, including the security of those networks, our operations could be disrupted and unanticipated increases in costs and/or decreases in sales could result," "We may fail to effectively manage confidential data, which could harm our reputation, result in substantial additional costs and subject us to litigation," and "Cyberattacks and security vulnerabilities could lead to reduced sales, increased costs, liability claims, unauthorized access to customer data or harm to our reputation."

companyName: Mueller Water Products, Inc.

ticker: MWA


text: The Companies' current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, the Companies have not experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. The Companies have identified the risk that a hostile cyber intrusion could severely impair the Companies' operations, lead to disclosure of confidential information, damage the Companies' reputation or otherwise have an adverse effect on the Companies' business as disclosed under the Operational Risks header within Item 1A. Risk Factors.

companyName: VIRGINIA ELECTRIC & POWER CO


text: 8x8 collaborates with third-party auditors, consultants, and participates in bug bounty programs to enhance its cybersecurity capabilities. External audits and assessments provide independent validation of the effectiveness of 8x8's cybersecurity controls, while bug bounty programs leverage the collective expertise of the cybersecurity community to identify and address potential vulnerabilities.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. The Company has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. We plan to consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and make the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: Skillz Inc.

ticker: SKLZ


text: During the period covered by this report, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, did not have a material impact on our business strategy, results of operations, or financial condition. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We are prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data they or their customers have entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Des Moines


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including risks from cybersecurity threats. The cybersecurity program is led by the Company's Global VP of Data Operations and Information Technology, who provides periodic updates to the Cyber Security Risk Management Committee of our Board of Directors about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Our Board of Directors engages in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives. The Cyber Security Risk Management Committee regularly reports on its activities to the full Board to promote effective coordination and to ensure that the entire Board remains apprised of the effectiveness of the cybersecurity risk management and the cybersecurity risk landscape, and also assesses how management is managing these risks.

companyName: PHOTRONICS INC

ticker: PLAB


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp III


text: We monitor and reassess our third-party relationships on an ongoing basis depending on risk level or in the event of a change of products and services provided to us. We also require third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to entering into a contract with us. The third-party risk assessments, conducted by our information security and enterprise risk management teams with input from key business stakeholders, involve understanding the products and services we obtain from the third party, what sensitive company and client data it will be able to access and an evaluation of the vendor's security program and documentation. We also require that certain information security-related contract terms be incorporated into agreements with third parties that will have access to sensitive information before entering into such agreements.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program described above.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer. This individual has over 30 years of work experience in various technology roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. This experience has included positions at large public companies. Our CIO also holds a degree in electrical engineering.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function and has delegated to our Audit Committee responsibility for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Fossil Group, Inc.

ticker: FOSL


text: affected unit or department are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Risks and Incidents We have experienced cybersecurity incidents in the ordinary course of business and recognize that such incidents are an inherent risk to any organization. While prior incidents have not materially impacted our business strategy, financial condition, or results of operations, we remain vigilant in anticipating and mitigating future threats.

companyName: HEICO CORP

ticker: HEI


text: We have internal Cybersecurity Council which meets monthly to help communicate our enterprise cybersecurity strategy and ensure it is implemented across the business, as well as maintain awareness of events and changes occurring throughout the business. The Cybersecurity Council consists of members from our CIO organization as well as senior leadership from various functional areas of the business.

companyName: AeroVironment Inc

ticker: AVAV


text: We use a variety of strategies and techniques designed to identify cybersecurity risks and reduce the risk of unauthorized access to internal and customer confidential information and critical business systems and platforms. This approach utilizes both internal and external resources and includes regular risk assessments (for example, penetration testing and annual self-assessments), ongoing employee training, proactive monitoring of our IT systems, encryption of certain types of information, and certain controls governing access to our facilities and systems.

companyName: Sonos Inc

ticker: SONO


text: OpenText has a cross-functional incident response team, led by our cybersecurity team and comprised of representatives from our information technology, cybersecurity, finance, and legal teams. The cybersecurity team primarily is responsible for the monitoring and assessment of potential cybersecurity occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of the Company and our customers information assets.

companyName: OPEN TEXT CORP

ticker: OTEX


text: As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.

companyName: Voya Financial, Inc.

ticker: VOYA


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. A member of our audit committee and board of directors with a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: The Company's Board of Directors has ultimate oversight of cybersecurity risk and aids in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews the cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least once annually, or more frequently as determined to be necessary or advisable.

companyName: BOSTON BEER CO INC

ticker: SAM


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has 23 years of expertise in cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information technology and information security throughout their career. The CISO holds various professional certifications, including the Certified Information Security Manager certification from the Information Systems Audit and Control Association and the Certified Information Systems Security Professional from International Information System Security Certification Consortium. The CISO holds a Bachelor's Degree in Computer Information Systems and a Master's Degree in Organizational Security Management.

companyName: MGM Resorts International

ticker: MGM


text: The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The NIST CSF offers a framework for cybersecurity management, including asset identification, systems protection, threat detection, and incident response and recovery. In particular, our cybersecurity strategy, as set forth in the Program, uses NIST Special Publication 800-53, which covers the steps in the CSF that address security safeguards across five dimensions of information security (Identification, Protection, Detection, Response, and Recovery). The Program guides the execution of our cybersecurity responsibilities for our digital infrastructure, including network security, endpoint security, data protection, incident response, awareness and training, compliance, and risk management.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has been material to the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."

companyName: Fox Corp

ticker: FOXA


text: As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Asset Backed Credit Co LLC


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks. The full impact of security events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: During February 2024, the Company hired an IT Manager with expertise in cybersecurity and risk mitigation. This hiring coupled with HUB's consultancy positions us to assess and mitigate cybersecurity threats and protect the Company's shareholders. date, no cybersecurity threats have materially affected our business strategy, operations, or financial condition.

companyName: BOXABL Inc.


text: Engaging Third Parties on Risk Management We collaborate with our clients, vendors and other third parties to develop information systems and protect against cybersecurity threats. We engage third-party security experts for risk assessments and program enhancements.

companyName: Cactus, Inc.

ticker: WHD


text: Third-Party Risk Management Advisors Recognizing the complexity and the evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program and practices. This ecosystem enables us to leverage specialized knowledge and insights, ensuring our cybersecurity program and practices remain attuned to our Company's particular needs and vulnerabilities. Our collaboration with these third-parties includes penetration tests on externally facings systems, threat assessments and subject matter expertise consultation on risk remediation and security enhancements.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted software as a service vendors, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our production server environments ("Information Systems and Data").

companyName: PlayAGS, Inc.


text: The Company contracts with third party service providers for its information technology and cybersecurity risk management functions. The Company's third party cybersecurity provider assesses risks to the Company from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the provider's cybersecurity standards, processes, and practices. To protect the Company's information systems from cybersecurity threats, the Company's third party cybersecurity provider uses various security tools that help the Company identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include but are not limited to, timely reporting of cybersecurity incidents to the Company, performing vulnerability testing, using tools and techniques to test security controls, monitoring emerging trends and regulations related to information security, and implementing appropriate changes, as needed, to the Company's cybersecurity protections.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: Our board of directors, also acting as our audit committee, is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our CEO is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.

companyName: Qrons Inc.

ticker: QRON


text: Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We firmly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving quarterly exercises, cyber-event simulations, training programs and an annual attestation to our Technology Acceptable Use Policy.

companyName: Mondee Holdings, Inc.

ticker: MOND


text: The Company faces various cybersecurity threats. The purpose of the Company's cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of the Company's business objectives.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 17 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.

companyName: Moelis & Co

ticker: MC


text: Additionally, although out of our control, cybersecurity incidents affecting oil and natural gas distribution systems maintained by third parties, or the networks and infrastructure on which they rely, could delay or prevent delivery of our production to markets, which could, in turn, have a material adverse effect on our business, financial condition and results of operations.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: In fiscal year 2025, we did not identify any cybersecurity threats, including those arising from prior incidents, that materially affected our business strategy, results of operations, or financial condition.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Cybersecurity Incidents InfuSystem is committed to transparency and promptly disclosing any material cybersecurity incidents that may impact our business, customers, or investors. As of the date of this report, we have not experienced any material cybersecurity incidents. Please see the Item 1A. Risk Factor above entitled "Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations" for more information regarding cybersecurity incident risks associated with InfuSystem.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: DIRTT engages external assessors annually for specific controls, to assess and provide assurance on the health of DIRTT's cybersecurity posture and controls.

companyName: DIRTT ENVIRONMENTAL SOLUTIONS LTD

ticker: DRTTF


text: We have also established a process to evaluate third-party vendors and suppliers for cybersecurity risk and compliance with our security standards. As applicable, on an annual basis we review System and Organization Controls (SOC) 1 reports for all significant third-party vendors. In addition to the efforts discussed above, we have developed and maintain an Incident Response Plan to establish a process for addressing cybersecurity incidents. The Incident Response Plan includes incident response teams in place at the corporate and operating company levels to respond to a potential cybersecurity incident, processes for internal and external reporting, and other procedures to facilitate response and coordination.

companyName: EMCOR Group, Inc.

ticker: EME


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.

companyName: MARINEMAX INC

ticker: HZO


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment, including, by regularly scanning our environment for vulnerabilities, performing penetration testing and engaging third parties to assess the effectiveness of our technical cybersecurity practices;

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: The board is also regularly briefed by management on the Company's cybersecurity policies, risk assessments, and mitigation strategies. This reporting structure allows the board to remain engaged with the company's efforts to address and manage evolving cyber threats, ensuring that cybersecurity is aligned with our overall risk management framework.

companyName: cbdMD, Inc.

ticker: YCBD


text: The Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats due to the significance of these threats to our operational integrity. The Board of Directors have delegated to the Audit Committee oversight over cybersecurity risk.

companyName: Cornerstone Building Brands, Inc.


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by a dedicated Head of Information Technology, who has over twenty years of experience in IT application management, infrastructure and security across a variety of industries including Financial Services, Defense Contracting, Manufacturing and Distribution, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Head of Information Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, key updates to our information security systems and programs as well as the current threat environment.

companyName: HF Foods Group Inc.

ticker: HFFG


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management and the Board of Directors, as appropriate.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Technical Safeguards: CTO and the MSP deploy technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention systems, endpoint detection and response systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: Our CIO is responsible for our information security program and controls, which includes cybersecurity risk management. Our VP, Information Technology leads our cybersecurity program and Information Security team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats and executing our information security controls. The CIO and VP, Information Technology have extensive cybersecurity knowledge and skills gained from each having over 20 years of relevant experience. The CIO and VP, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from the Information Security team and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for the Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Agriculture & Natural Solutions Acquisition Corp

ticker: ANSC


text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. Additional role-based training is provided to finance team members, due to the elevated privilege and risk associated with their duties. All employees are also tested periodically for their cybersecurity awareness.

companyName: Third Harmonic Bio, Inc.


text: SLB’s Cyber Security Director reports to SLB’s Chief Information Officer and is the head of the Company’s cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB’s cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by SLB.

companyName: SLB LIMITED/NV

ticker: SLB


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party vendors and service providers. We have in place a Third-Party Cybersecurity Risk Management program to assess the cybersecurity practices of third-party vendors and service providers with access to our and CoreSite's systems or information.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Our Board of Directors considers cybersecurity risk as part of its overall enterprise risk oversight function and has delegated to the Audit Committee primary oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of the adviser and FS Investments, including the Chief Information Security Officer ("CISO"), of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our Chief Technology Officer, in coordination with our Head of Security and our internal security staff, is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Continuous Security Assessments: We conduct regular cybersecurity audits, third-party risk assessments, penetration tests, and targeted control evaluations to identify and remediate potential vulnerabilities. Our security program is continuously monitored and assessed by an external 24/7 Security Operations Center (SOC).

companyName: Korth Direct Mortgage Inc.


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. The information technology department ("IT Department"), which includes the cybersecurity department ("IT Security Department"), is responsible for implementing such processes and coordinating with the Human Resources Department to align training and onboarding efforts with such processes.

companyName: Braemar Hotels & Resorts Inc.

ticker: BHR


text: Cybersecurity and Risk Management The Company's cybersecurity risk management processes are integrated into the overall risk management process managed by the Chief Risk Officer through reporting of cyber risks to the Information Security Steering Committee (ISSC). The ISSC is chaired by the Managing Director of Information Security, who has 17 years of information technology (IT) and information security experience in the financial services industry. Key metrics are monitored on an ongoing basis by the IT Risk Management and IT Security teams, with oversight by the ISSC. IT Risk Management performs regular information security-focused risk assessments, including but not limited to assessments based on the Center for Information Security Controls Self-Assessment Tool and Ransomware Self-Assessment Tool aligned to the Federal Financial Institutions Examination Council standards.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:

companyName: STORE CAPITAL LLC


text: Our cyber risk assessment program is managed by our Corporate Security team, which is led by our CSO, who has over 25 years of experience in the cybersecurity and technology industry. The CSO reports to Cognizant's Executive Vice President, Chief Legal Officer, Chief Administrative Officer and Corporate Secretary. The CSO manages multiple teams within Corporate Security that are operationally responsible for the security of the Company, including Global Cyber Operations, Business Information Security, Global Business Resilience and Integrated Risk Management, each of which provides regular updates to the CSO regarding cyber threat intelligence, cyber incidents and cyber risk metrics as part of their security responsibilities. The CSO works closely with the CIO, who is responsible for Cognizant's information technology and digital transformation strategy. Together, the CSO and CIO have a mutual set of responsibilities to align, implement and govern security policies, standards and technology controls throughout the enterprise. On a periodic basis, the CSO and CIO provide updates to the Audit Committee on, among other things, key cybersecurity metrics, status of projects to strengthen the Company's information security systems and assessments of the Company's security program. The Audit Committee reports to the Board of Directors, which also receives periodic updates on such matters.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factor If we or our third party providers fail to protect our IT Systems against security incidents, or otherwise to protect our Confidential Information, there may be damage to our reputation and brand, material financial penalties, and legal liability, which could substantially harm our business, financial condition, and results of operations.

companyName: Expensify, Inc.

ticker: EXFY


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats (as such term is defined in Item 106(a) of Regulation S-K), including, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Canton Strategic Holdings, Inc.

ticker: CNTN


text: As discussed in more detail under the heading "Governance" below, our Board and management devote significant time to cybersecurity risk oversight. The Board annually reviews our overall cybersecurity risk profile to help ensure that sensitive data remains secure in an ever-changing threat landscape, including risk preparedness and mitigation strategies. This assessment considers a range of factors, including our business objectives, the threat landscape, industry trends and regulatory requirements. The Audit Committee of the Board ("Audit Committee") oversees our cybersecurity risk management and regularly meets, not less than quarterly, with our Chief Information Security Officer ("CISO") and other members of management, including those with significant roles in our cybersecurity efforts. Our Executive Steering Committee, described below, provides senior management oversight to our cybersecurity program.

companyName: PROS Holdings, Inc.


text: Under the direction of our CIO, our CISO leads the execution of the cybersecurity risk management program for our enterprise and operational technology systems. Our CISO is a seasoned cybersecurity executive with over 30 years of broad digital technology experience at Air Products. Our CISO has experience in leading global enterprise and operational technology cybersecurity programs, maintains a Certified Information Systems Security Professional certification, and has completed CISO executive education at Carnegie Mellon University. The Information Security leadership team that reports to the CISO is composed of four security leaders with over 80 years of combined experience and multiple professional certifications.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Potential Risk Exposure: While we have not experienced significant disruptions from cyber threats, we recognize the evolving nature of cyber risks. We continually evaluate the likelihood of potential cybersecurity incidents that could materially impact our strategic direction, operational efficacy, and financial stability. Our investment in training, alongside our sophisticated SOC, SIEM, and Zero Trust architecture, positions us to identify and address potential cybersecurity challenges promptly.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Audit Committee is responsible for oversight of the Company's cybersecurity risk exposure. The CCPO provides reports to the Audit Committee and Board at least annually, which include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: AGILE THERAPEUTICS INC


text: One of the key functions of our board of directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our board of directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the board of directors. This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Assessment of Cybersecurity Risk In the past three years, we have not experienced a material cybersecurity breach and the potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including its business strategy, operational results, and financial condition.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: In addition, an external consultant in conjunction with the Company conducted a cybersecurity gap assessment in November 2023 to review and confirm that the Company has appropriate measures in place to assess, identify and manage cybersecurity risks, and the Company is implementing the recommendations made as a result of the gap assessment.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW