text: Our Chief Technology and Delivery Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our Executive Director, Corporate Information Systems, along with our General Counsel, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our Executive Director, Corporate Information Systems, has served in this role for two years and has access to Vericel's external information security firm and an industry-leading intelligence platform. This Executive Director manages and leads the internal Information Technology team to maintain and update the company's technology infrastructure and corresponding safety measures.

companyName: Vericel Corp

ticker: VCEL

secItem: Item 1C


text: The Audit Committee of our Board of Directors (the "Audit Committee") oversees risks pertaining to cybersecurity. The Chief Operating Officer regularly reports to the Audit Committee, and directly to the Board of Directors, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters.

companyName: BAIYU Holdings, Inc.


text: To further strengthen the Bank's preparedness, cybersecurity insurance coverage is maintained with coverage levels periodically reviewed to ensure alignment with the risk appetite.

companyName: FB Financial Corp

ticker: FBK


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at GCI. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Cybersecurity risk is evaluated based upon risk-based approach. An analysis of information and technology assets that ranks the assets based upon their risk of potential internal and external threats and the impact of the potential loss of integrity, confidentiality, and availability of that asset is updated as appropriate.

companyName: Ridgewood Energy O Fund LLC


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, although we cannot rule out that a cyber attack in the future could materially affect our ability to operate.

companyName: Array Technologies, Inc.

ticker: ARRY


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: Risks Associated with our Business and Industry.

companyName: Lexaria Bioscience Corp.

ticker: LEXX


text: The ISPEC provides comprehensive strategic guidance, coordination, and oversight of the Company's information security and privacy programs and governance, including the Cybersecurity Program, Data Privacy Program, Information Technology Policies, and data breach and cyber incident testing, plans, and operational response. The ISPEC meets quarterly and is co-chaired by the CIO and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. The ECC oversees key risk areas, which include IT and Cyber. The CIO is a key risk owner for the IT and cybersecurity domain and works with the ECC to effectively mitigate compliance risk within our functional regulatory area. This council meets quarterly and is chaired by the SVP General Counsel & Chief Compliance Officer and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. RADIUS RECYCLING, INC.

companyName: RADIUS RECYCLING, INC.


text: The following members of Company management are tasked specifically with the responsibilities described below: • Cybersecurity Incident Response Team ("CIRT") – The CIRT was established to provide quick, effective, and orderly responses to serious successful cybersecurity related incidents such as system and application outages, virus infections, hacker attempts, system compromises, improper disclosure of confidential information, system service interruptions, breach of personal identifiable information, or other technology related events with serious security implications or business disruptions.

companyName: FIRST INTERSTATE BANCSYSTEM INC

ticker: FIBK


text: Despite the systems and processes the Company has in place to monitor, detect, mitigate and remediate potential vulnerabilities, on June 30, 2024, the Company detected a cybersecurity incident in which an unauthorized third party gained access to certain information systems of the Company, which resulted in the Company incurring expenses, including expenses to retain external cybersecurity experts to assist with an investigation into such incident. For additional information, see Note 14 "Commitments and Contingencies" included in Part IV, Item 15 of this Report.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: We engage consultants, experts, or other third parties in connection with our risk assessment processes. These third parties assist us in designing and implementing our cybersecurity policies and procedures, as well as in monitoring and testing our safeguards.

companyName: Cyclo Therapeutics, Inc.


text: The Board of Directors believes that control and management of risk are primary responsibilities of senior management of the Company. As a general matter, the entire Board of Directors is responsible for oversight of this important senior management function. The Audit Committee is responsible to the Board for the organizational oversight of the Company's comprehensive enterprise risk management plan, including cyber risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: GORMAN RUPP CO

ticker: GRC


text: We maintain a robust privacy compliance program. Employees receive periodic email communications, which train them to detect and report malware, ransomware and other malicious software and social engineering attempts that may compromise our information technology systems. In the second quarter of 2024, we implemented the KnowBe4 security training system and completed our first annual training in August 2024. In 2025, we plan to move to a quarterly testing regimen.

companyName: JOINT Corp

ticker: JYNT


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Aimco OP L.P.


text: Tredegar's IT Director has over 10 years of cybersecurity expertise, including a robust history of similar roles, cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco. Our IT Director is responsible for overseeing the Program, including the prevention, mitigation, detection, and remediation of cybersecurity incidents. Tredegar's IT Director also regularly collaborates closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication within Tredegar.

companyName: TREDEGAR CORP

ticker: TG


text: We have also developed an incident response plan, designed to identify suspected or confirmed information security or cybersecurity events based on the expected risk an event presents, and expediently move such information through the appropriate personnel and channels. The plan details the sequence of steps and relevant personnel, roles, communication procedures, and incident response process flows to be used in the event of an applicable incident. Our Disclosure Committee, which is composed of certain of our senior management, legal and operations teammates, plays an integral role in this process, by supervising external reporting of cybersecurity incidents. Among other items, our procedures require calling an ad hoc committee meeting within 24 hours of incident identification for incident materiality assessment and determination.

companyName: TaskUs, Inc.

ticker: TASK


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. The Company tracks numerous risk metrics relating to cybersecurity, and at each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the metric's trend of increasing or decreasing risk. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee described above is included the materials for ERM Committee meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, the CISO attends ERM Committee meetings, providing additional detail, and answering committee members' questions, about the CISO's report.

companyName: RENASANT CORP

ticker: RNST


text: Our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks, and is assisted in these efforts by the Audit Committee of the Board. Our IT team is responsible for assessing and managing our risks from cybersecurity threats. Our IT team is led by our Vice President of Information Technology and Security, who reports directly to our Chief Financial Officer. During 2023, our Chief Information Officer (who has been serving as our Chief Commercial Officer since January 2024) provided updates on cybersecurity threats and risks to our Board of Directors and to the Audit Committee of our Board of Directors. In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2023, as part of their oversight of our enterprise risk management process.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Airship has had one cybersecurity incident in the last decade. The Company was the victim of a ransomware virus that encrypted several machines on Airship's corporate network. The threat was quickly identified and isolated before significant damage could be done. The attack did not affect business operations and did not have a significant financial impact on the Company. Most files affected had backup and Airship was able to remove affected files and restore them from backup.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: The Company has developed cybersecurity incident response plans to contain, investigate, respond to, and recover from cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Key members of management, including the Company's Chief Financial Officer, Chief Operating Officer, and Chief Legal Officer, as well as employees from IT, internal audit, marketing and communications, and human resources, serve on the Company's security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk.

companyName: Red Rock Acquisition Corp.


text: We use an internal management committee to run our information and technology function, comprised of information technology, finance, and legal employees, and led by our Vice President – Information Technology and Automation, and Chief Financial Officer, each of whom have experience managing the information and technology functions, and cybersecurity safeguards, at multiple prior companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee annually with an overview of our cybersecurity threat risk management and strategy processes. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding material new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.

companyName: Humacyte, Inc.

ticker: HUMA


text: If the Cyber Security Subcommittee determines there is a reasonable likelihood a notable cybersecurity incident has occurred, then notice will promptly be given to certain members of the Company Executive Team including our Chief Executive Officer, Chief Operating Officer, Chief Commercial Officer & Chief Financial Officer.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: Management plays a crucial role in assessing and managing material risks from cybersecurity threats. At the management level, the Company's cybersecurity risk management and strategy is led by its Head of Product and Operations, who reports to the CEO. The qualifications of the Head of Product and Operations include over 20 years of IT management, cybersecurity, and information governance experience. The Head of Product and Operations is regularly informed about the latest developments in cybersecurity, including emerging threats and technologies to adapt security measures accordingly. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Periodically, we engage consultants and other third parties to assist in the continued improvement of our cybersecurity program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address vulnerabilities. Examples of these engagements include penetration testing, risk assessments, and cybersecurity control audits.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Threat Mitigation While we engage in numerous efforts to protect ourselves from cybersecurity risks, we do periodically experience cybersecurity incidents. To date we have not experienced any cybersecurity threat or incident that has materially affected our business, results of operations or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats that are constantly evolving over time, there is no guarantee that we, including our business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.

companyName: RH

ticker: RH


text: Data Inc. does not currently engage with third parties in connection with cybersecurity risk management. Third-party consultants including cybersecurity auditors are being considered for future engagement, at which point any risks stemming from the use of third parties will be incorporated in the cybersecurity risk assessment.

companyName: Vertical Data Inc.

ticker: VDTA


text: The Board of Directors is responsible for exercising oversight of management's identification of, and planning for, the material risks facing the Company, and we believe our risk management policies and procedures are adequate to ensure that relevant information about cybersecurity risks and incidents is appropriately reported and disclosed. In October 2017, the Board authorized the formation of a Cybersecurity Committee, which is now known as the Governance, Risk & Compliance ("GRC") Committee. Our cybersecurity risk management process, which are discussed in greater detail below, are led by the GRC Committee. The GRC Committee is currently comprised of the Chief Technology and Innovation Officer, Chief Financial Officer, General Manager of TruBridge, General Manager of EHR, General Manager of Patient Engagement, Corporate Security Officer, and General Counsel and Corporate Compliance Officer. The GRC Committee generally meets weekly, and has a formal meeting quarterly, to discuss the primary security and compliance-related risks currently facing the Company, including cybersecurity risks. The General Counsel and Corporate Compliance Officer then provides updates to the Board at each regular quarterly meeting. Annually, the full Board participates in cybersecurity training and discusses the internal incident management process with the GRC Committee.

companyName: TruBridge, Inc.

ticker: TBRG


text: Should a cyber event occur, depending on the severity of an event, our cyber incident reporting process includes informing, as early as practicable, our senior corporate management.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Critical elements of our ISMS include: • Operational measures to monitor and respond to data breaches and cyberattacks. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities, protect our applications, and alert incident response personnel. Security incidents are addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications. • Preventative measures to hinder or limit cyberattacks. We procure, develop, deploy, and maintain preventative solutions and follow preventative practices for our corporate IT and product engineering infrastructures, as well as the production infrastructure that processes our customer data. These solutions and practices include identity and access management, separation of duties, secure software development, network and data security, and system hardening. • Vulnerability and penetration testing. We commission annual vulnerability and penetration testing of certain systems by industry-recognized, third-party security specialists. In addition, our software products undergo internal vulnerability testing using automated and manual methods prior to general availability. • Training. We require role-based security and security awareness training. All employees receive annual training on our Code of Conduct and our Acceptable Use Policy, which establishes our commitment to protecting the confidential and proprietary information of our customers and partners. In addition, all new hires and contractors must undergo information security awareness training. Subsequent security awareness training is required annually for all active employees and contractors. Employees are trained to promptly report security incidents. Employees in certain roles (e.g., customer support representatives, developers, and hiring managers) receive more extensive data and application security training annually. • Disaster recovery and business continuity. Our solutions are designed to help avoid single points of failure to reduce the chance of business disruption from security breaches, incidents, and other disruptions of systems. We maintain formally documented recovery processes that may be activated in the event of a significant business disruption of our corporate IT infrastructure or the production infrastructure that processes our customer data. We conduct testing, at least annually, to verify the validity of the recovery processes and provide reports on the test results for production infrastructure that processes our customer data to customers via access to a customer portal.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Our Information Technology department, led by our Senior Vice President, Information Technology, helps to detect, respond to, and manage cybersecurity threats and risks by monitoring and evaluating our threat environment using various manual and automated tools in certain environments and systems and other methods including, for example: analyzing reports of certain threats and actors; conducting scans of the threat environment; evaluating our and our industry's risk profile; evaluating certain threats reported to us; conducting internal and external audits; conducting threat assessments for certain internal and external threats; and conducting vulnerability assessments designed to identify vulnerabilities.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, management and the Audit Committee oversees cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Theriva's management team is responsible for oversight and administration of cybersecurity risk management strategies, and for informing the Board and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Theriva Biologics, Inc.

ticker: TOVX


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. Specifically, the Board is assisted by the Audit Committee and the ESG and Risk Committee, which oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks, and reports to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the ESG and Risk Committee. These presentations cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board, the Audit Committee and the ESG and Risk Committee regularly discuss cybersecurity and information security risks with our senior executives. As part of our cybersecurity governance, we also utilize a Cybersecurity Steering Committee comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as appropriate, to review, assess and direct decisions related to cybersecurity and information systems matters.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information.", for additional discussion about cybersecurity-related risks.

companyName: TPG Twin Brook Capital Income Fund


text: Seadrill is dedicated to upholding comprehensive cybersecurity policies and procedures to safeguard our assets, data, and stakeholders. We achieve this by continuously assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program is built upon the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Cybersecurity risk is an integral part of our Enterprise Risk Management ("ERM") program, which evaluates potential impacts to our operations, financial stability, and reputation.

companyName: Seadrill Ltd

ticker: SDRL


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Cadrenal acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: Roles of our Board of Directors and Management Our Board has delegated both the Audit Committee and Technology & Operations Committee with responsibility for monitoring and oversight of the information technology and cybersecurity components of our risk assessment and risk management programs. The independent directors comprising our Audit Committee and our Technology & Operations Committee: • regularly review our cybersecurity and related information technology risks, controls and procedures, including data protection and privacy and our plans to mitigate cybersecurity risks and to respond to data breaches; • provide expertise and insight regarding technology and operations systems and processes that relate to or affect our internal control systems, information security, data protection and privacy, fraud and cybersecurity risks; and • assist management in developing our risk management methodologies and the steps taken to identify, monitor and control such exposures.

companyName: WORLD KINECT CORP

ticker: WKC


text: Management has primary responsibility for risk management within our Company. The Company's Board of Directors, with the support of its committees, oversees risk management to ensure that the processes designed, implemented and maintained by our executives are functioning as intended and adapted when necessary to respond to changes in our Company's strategy as well as emerging risks. The Audit Committee of the Company's Board of Directors has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses. The Audit Committee receives reports on these matters from our most senior executives in the digital organization, including our Chief Information Officer and CISO, and the Company's executive officers, at least twice a year. Topics historically covered in such reports, and for which our Board exercises oversight, include third-party evaluation of our technology infrastructure and information security against the NIST cybersecurity framework; management of emerging cyber threats such as merger and acquisition activity and the adoption and governance of artificial intelligence; risk mitigation through the Company's enterprise-wide cybersecurity training, including our Board of Directors, conducted at least annually; regular simulated phishing tests and third-party penetration testing; review of the Company's cyber incident insurance coverage and external cyber incident resources; review of the Company's Cybersecurity Incident Response Plan; review of readouts from cyber incident table top exercises; and consideration of applicable laws and regulations, including those related to privacy. The Company's Cybersecurity Incident Response Plan includes a section on Board escalation that specifies the process for notification of the Chair of the Audit Committee and the Chair of the Board of the Directors upon certain triggering events, and that group then determines the appropriate form and frequency of communication with the full Audit Committee or Board of Directors, depending on the unique characteristics of the incident.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Janus International Group, Inc.

ticker: JBI


text: Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: We periodically perform simulations to test employees and provide any necessary remedial training. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training online. We may also require employees in certain roles to complete additional role-based, specialized cybersecurity training. We continue to expand investments in IT security, taking a multi-layered security approach, which includes additional end-user training, improving security defenses, network segmentation, identifying and protecting critical assets, strengthening monitoring, and alerting, and leveraging industry experts where available.

companyName: Workhorse Group Inc.

ticker: WKHS


text: The Quality and Compliance Committee of our Board of Directors provides board-level oversight of cybersecurity risk. As part of its oversight role, the Quality and Compliance Committee receives reports about our practices, programs, or notable threats or incidents related to cybersecurity throughout the year, including through periodic updates from our CISO and other leaders. The Quality and Compliance Committee provides regular reports to the full Board about these matters and other areas within its responsibility, and the CISO and other leaders provide updates regarding cybersecurity matters to the full Board as appropriate.

companyName: Option Care Health, Inc.

ticker: OPCH


text: We have been, and expect to continue to be, subject to cybersecurity risks and incidents related to our business. We have not experienced any material cybersecurity incidents during the last fiscal year. For more information about the cybersecurity risks we face, see Part I, Item 1A, "Risk Factors " of this Annual Report on Form 10 -K.

companyName: Azenta, Inc.

ticker: AZTA


text: We leveraged internal and external resources to support our cyber risk management efforts, including security monitoring tools, periodic penetration tests and vulnerability assessments, and employee cybersecurity awareness training. We have in the past also engaged the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Robust cybersecurity is an essential component of our strategic vision. We face a variety of complex cybersecurity threats as a defense contractor. Among the risks are computer malware, ransomware, phishing attacks, Denial of Service attacks and Advanced Persistent Threats. Our security team, comprised of members from senior management, IT, human resources and program management, performs routine risk assessments in accordance with NIST 800-30, using input from observed risks and threats, advisories, federal agencies and local law enforcement. The Audit Committee of the Board of Directors is responsible for oversight of our risk management processes. The Audit Committee is briefed by senior management on cybersecurity posture, initiatives and incidents. We allocate significant resources to mitigate these risks. We are required to adhere to rigorous regulations, such as those outlined in the Defense Federal Acquisition Regulation Supplement (DFARS), which govern the protection of controlled unclassified information (CUI) and the mandatory reporting of cybersecurity incidents to the Department of Defense (DoD). All DFARS requirements are flowed down to our sub-contractors, who are required to self-report their compliance to the U.S. Government. In addition to the processes and systems that we use to identify and mitigate risks, we utilize third party services to conduct valuations of our security controls, including penetration testing and independent audits. Despite our efforts to uphold the highest cybersecurity standards, we may still experience a cybersecurity incident that has a material effect on business strategy, results of operation or financial condition. It is also possible that additional regulations could affect our supply chain and increase costs. Prior cyberattacks directed at us have not had a material impact on our financial results nor restricted us from being awarded contracts from other defense companies or directly from the United States Department of Defense. However, we can provide no assurance that the occurrence of any future event would not adversely affect our internal operations, our reputation and competitive advantage, and our future financial results.

companyName: ESPEY MFG & ELECTRONICS CORP

ticker: ESP


text: The Nominating & Governance Committee, which is comprised entirely of independent directors, has primary responsibility for oversight of the Company's initiatives, policies and performance regarding risk management matters, including information security, cybersecurity, business continuity and data protection and privacy. Committee members have extensive experience working for and/or serving on the boards of directors of publicly traded companies and are experienced in overseeing cybersecurity and information security risks, understanding the cybersecurity threat landscape and/or assessing emerging cybersecurity risks. The Nominating & Governance Committee generally meets at least quarterly and as frequently as circumstances dictate. Members of senior management, representing a variety of teams and functions including information technology, operations, finance and legal, routinely provide updates regarding assessments of cyber risks, the threat landscape, and the Company's cybersecurity risk mitigation and governance strategies. The Nominating & Governance Committee and members of senior management brief the entire board, as necessary, on cybersecurity matters discussed during committee meetings.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We describe cybersecurity risks have or that are reasonably likely to affect our Company under the heading " Information Technology and Cybersecurity Risks " included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risks. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Risk Oversight Committee. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants, legal advisors, and audit firms in evaluating and testing the Company's risk management systems and assessing and remediating certain potential cybersecurity incidents as appropriate.

companyName: STURM RUGER & CO INC

ticker: RGR


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Hapi Metaverse Inc.


text: The Company has implemented a formal cybersecurity program aligned to the Secure Controls Framework (SCF), a cybersecurity and privacy framework that consolidates and maps controls across multiple regulations, standards, and best practices. The Company's program includes the evaluation of the cybersecurity posture of third-party suppliers and vendors that have access to the Company's data or information technology systems. Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures, and implements appropriate mitigation measures. Mitigation of identified threats and vulnerabilities may be delayed.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: The Adviser conducts periodic assessment and testing of its policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. This includes penetration testing of network infrastructure and phishing tests targeting the Adviser's employees. The results of such assessments and reviews are evaluated by management and reported to the Board, and the Adviser adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments and reviews.

companyName: TCW Direct Lending VIII LLC


text: In the normal course of business, we also collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, customer information including bank account information and invoice and payment information, sensitive third-party information and employee information, and certain personal information. To protect this information and our systems, our existing cybersecurity policies require monitoring and detection programs, network security measures, and encryption of critical data. Additionally, we have processes in place that are designed to assess and manage cybersecurity risks associated with our use of third-party service providers.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: We have no employees and are externally managed by the Manager, an affiliate of the Sponsor. The Manager is responsible for the overall management of our activities, subject to oversight by our board of directors.

companyName: CNL Strategic Capital, LLC


text: Please refer to the risk factor titled "We have experienced cyber attacks and breaches, and may in the future experience cyber attacks and breaches which could cause operational disruptions, fraud or theft of sensitive information." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: The IT Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the IT Committee, as necessary, regarding any significant cybersecurity incidents.

companyName: EVERTEC, Inc.

ticker: EVTC


text: Cybersecurity threats, including those resulting from previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: REGAL REXNORD CORP

ticker: RRX


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; reputational harm; a loss of customers or sales; and other adverse consequences."

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: We regularly review and update our investments in information technology security to identify and protect critical assets, provide monitoring and alerts, and, as needed, engage third-party experts. To assess the effectiveness of our Program, we have engaged consultants to conduct penetration testing and other vulnerability assessments. Additionally, our Internal Audit department and external auditors conduct assessments of different systems to provide the Audit Committee with information on our risk management processes, including cybersecurity risk management. We also test our defenses internally and conduct regular cybersecurity simulations and tabletop exercises with members of executive management present. These tests and assessments provide useful insights into the strengths and weaknesses of our cybersecurity framework.

companyName: BROOKLINE BANCORP INC


text: In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition or results of operations. With regards to risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have conducted assessments and have determined that we do not believe any of the identified risks have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all financial institutions, we face a risks of such threats, the consequences of which could be material. See Item 1A "Risk Factors – We are subject to operational risks relating to our technology and information systems," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Our executive leadership team, along with oversight from the Audit Committee of the Board of Directors, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. The Audit Committee oversees the processes by which management assesses the Company's exposure to cybersecurity risks and evaluates the guidelines and policies governing the Company's monitoring, control, and minimization of such risks. Our CTO regularly reports to the Audit Committee regarding cybersecurity matters. For additional information concerning cybersecurity risks we face, refer to Part I, Item 1A, Risk Factors.

companyName: Churchill Downs Inc

ticker: CHDN


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards with regular evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests, and incident response simulations. We also require cybersecurity training when onboarding new employees and contractors, as well as required cybersecurity awareness training for our employees and contractors/other workforce members. Our program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: EyePoint, Inc.

ticker: EYPT


text: Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cyber Security Framework and regularly reassess our cybersecurity program. The NIST framework is structured around five commonly defined stages (Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our policies, including our Information Security Policy and Privacy Policy, and procedures are designed to align with industry best practices and comply with regulatory requirements. We align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard. Throughout the year, we conduct targeted audits and assessments, using internal and external resources, of certain aspects of our information security systems. We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, ensure the integrity of critical data and automated processes, and safeguard the availability of our information technology capabilities.

companyName: US Foods Holding Corp.

ticker: USFD


text: The Chief Information Security Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Chief Information Security Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Confluent, Inc.

ticker: CFLT


text: Our information protection department maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets and its interaction with business, information technology and security parties, internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management to ensure appropriate oversight of cybersecurity risk management activities.

companyName: Cigna Group

ticker: CI


text: The CSLT supervises our efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through a variety of means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and reports from cybersecurity systems deployed in our information technology environment.

companyName: Avery Dennison Corp

ticker: AVY


text: Numerous and evolving cybersecurity threats pose potential risks to the security of our IT systems, networks and services, as well as the confidentiality, availability and integrity of our technology systems and data. In addition, the laws and regulations governing security of data on IT systems is evolving and adding another layer of complexity in the form of new requirements.

companyName: ALLIENT INC

ticker: ALNT


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The enterprise risk management's annual risk assessment is presented to the board of directors.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. We also engage third-party consultants to conduct regular assessments of our cybersecurity safeguards. Our internal Information Technology ("IT") team conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on third-party service providers for alerts regarding suspicious activity.

companyName: Sitio Royalties Corp.


text: Chaired by Jonathan Gross, who holds the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD) and Carnegie Mellon University, the Cybersecurity Committee of the Company's Board of Directors is responsible for assisting the Board of Directors in fulfilling its oversight responsibilities with respect to (i) cybersecurity risks and (ii) policies and practices to monitor and mitigate cybersecurity risks. The Company's Board of Directors and its Cybersecurity Committee are briefed regularly on Tellurian's cybersecurity risks and other cybersecurity-related matters. Additionally, we have established the Cybersecurity Management Committee to provide executive oversight of our cybersecurity risk management processes. The Cybersecurity Management Committee is chaired by Michael Dean, our Chief Information Security Officer (CISO), who has over 30 years of cybersecurity management and information technology leadership experience, and includes our Chief Executive Officer, President, General Counsel and Chief Accounting Officer, among other members of our management team. The Cybersecurity Management Committee holds regular meetings at least quarterly and special meetings as necessary to review identified cybersecurity threat risks or incidences and monitor the operation of our incident response plan. As part of our incident response procedures, our CISO is required to report any identified material cybersecurity incident promptly to our Chief Executive Officer, our President and the Cybersecurity Committee.

companyName: TELLURIAN INC. /DE/


text: Management's Responsibilities In the event we identify a potential cybersecurity issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders, and law enforcement when responding to such issues. We have a dedicated management team overseeing our cybersecurity initiatives, led by our Chief Information Officer, our Vice President and Global Data Privacy Officer, and our Vice President of Cybersecurity. Our Chief Information Officer has over 25 years' experience overseeing and managing information technology teams and complex IT systems, and our Vice President of Cybersecurity has over 15 years' experience developing and managing cybersecurity functions and strategies. Our Vice President of Global Data Privacy is a recognized leader in the industry with over 7 years of experience in managing global data privacy programs. Our cybersecurity management team regularly meets with senior executives and other team members to provide oversight with respect to our cybersecurity risk detection, identification, assessment, classification, and mitigation efforts.

companyName: Bally's Corp

ticker: BALY


text: Phreesia takes a cross-functional approach to address the risks from cybersecurity threats. The Company's Board of Directors (the "Board") maintains oversight responsibility over the Company's enterprise risk management ("ERM") program, which incorporates the Company's cybersecurity risk management program. The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Chief Technology Officer, along with other members of management including the Chief Information Security Officer, the Chief Privacy Officer, and the compliance, audit, and risk teams.

companyName: Phreesia, Inc.

ticker: PHR


text: The Information Security Program is a key part of our overall risk management system, which is administered by our Information Technology Steering Committee. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: As of the date of this Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: We employ a comprehensive, cross-functional approach to assess, identify, and manage material cybersecurity risks, ensuring the confidentiality, security, and availability of our information systems and data. Our cybersecurity strategy is guided by applicable laws and regulations, industry standards, and best practices. We have established robust policies, standards, and processes to proactively safeguard our digital assets, mitigate risks, and respond effectively to cybersecurity incidents.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical information technology ("IT") systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. We designed and assess our cybersecurity risk management program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as well as information security standards issued by the International Organization for Standardization, including ISO 27001, which we use as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our global information security management program is ISO 27001:2013 certified.

companyName: FLEX LTD.

ticker: FLEX


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in information technology, including prior experience in cybersecurity architecture. We have a diverse information security team, including external consultants, with varying backgrounds and experience and levels of information security certification.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of strategic risk, including cybersecurity risk oversight. The Audit Committee receives regular reports on at least a quarterly basis from our cybersecurity team, led by our Chief Information Officer, typically on, among other things, our cybersecurity posture, cybersecurity benchmarking, potential cybersecurity vulnerabilities, and other cybersecurity interest items such as the external cybersecurity environment, items requiring Audit Committee input, and our broader cybersecurity program roadmap, in order to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The Audit Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, incident response, security operations, vulnerability management, risk and compliance and security engineering. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of relevant issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates, as needed, with external legal advisors, communication specialists, and other key stakeholders.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: To ensure threat and vulnerability information is up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide alerting and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Our Board has overall oversight responsibility with respect to the Company's approach to risk management, including cybersecurity risks. Although the Board has the ultimate responsibility for risk oversight, operational responsibility for cybersecurity matters is delegated to the Chief Information Officer ("CIO") who oversees all technology needs of the Company, including the assessment and management of material risks from cybersecurity threats. The CIO has over thirty years experience in bank operations including network security and cybersecurity matters. The Bank employs a full-time Cybersecurity Analyst ("CA") who brings over twenty-five years of information technology and network security experience to the role. In addition, we have various management- and Board-level committees that also oversee risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. Information security matters are a standing topic for the Management-only Technology Steering Committee ("TSC") where membership includes the CIO, CA and other senior level managers, and the Management-Board level Enterprise Risk Management ("ERM") Committee where membership includes the CIO, senior level managers, and a representative from the Board. Minutes from each ERM session are reported to the Audit Committee of the Board, and the CIO provides information security updates at each meeting of the Board.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: Containment, eradication, and recovery may be aided by third-party vendors or investigators. The incident response coordinator, in consultation with the IRT and management, will engage all third parties involved in the incident.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. See "Item 1A – Risk Factors – Technology, Cybersecurity and Privacy Risks – The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business", " – Technology, Cybersecurity and Privacy Risks – We could incur significant liability if our technology systems or those of third parties are breached or we or third parties otherwise fail to protect the security of data residing on our respective systems, which could adversely affect our business and results of operations" and " – Business Strategic and Operational Risks – Our inability to successfully recover should we experience a business continuity event could have a material adverse effect on our business, financial condition and results of operations" for more information.

companyName: ASSURANT, INC.

ticker: AIZ


text: The Risk Steering Committee reports to the Risk Oversight Committee of our Board of Directors at the regular quarterly meetings, or more frequently as needed. The Risk Oversight Committee's duties include, among other things, oversight of risks related to information technology security. The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight.

companyName: BLACKBAUD INC

ticker: BLKB


text: In addition, the Company's Board, both as a whole and through its Risk and Information Technology Committee (Risk Committee) is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board and the Risk Committee, with support from the Company's management and third party cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. The Board reviews and approves an information security program, vendor management policy (including third-party service providers), acceptable use policy, incident response policy and business continuity planning policy on an annual basis. All the aforementioned policies are developed and implemented by management of the Company. To carry out their duties, the Board receives updates from the Risk Committee regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents on at least a quarterly basis.

companyName: WEST BANCORPORATION INC

ticker: WTBA


text: Third-Party Cybersecurity Risk Management We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business. We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program. When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following: • including provisions in vendor contracts that set minimum cybersecurity requirements; • installing monitoring software to detect malicious software and activities in third party systems; • monitoring for and applying patches to third-party hardware and software to address vulnerabilities; and • performing security assessments before engaging new vendors or acquiring new hardware and software.

companyName: GoDaddy Inc.

ticker: GDDY


text: Certain employees of Greystone Manager that provide services to the Partnership are responsible for assessing and managing material risks from cybersecurity threats and are overseen by the Partnership's Chief Financial Officer. The Chief Financial Officer and relevant Greystone Manager employees collectively have over 20 years of experience in information technology risk assessment and audit evaluations. These individuals will also consult with experts from Greystone's affiliate that provides information technology managed services systems, particularly the Chief Information Security Officer of the Greystone affiliate, when assessing and evaluating risks of cybersecurity threats. These consultations with the Chief Information Security Officer typically encompass a broad range of topics, including the current cybersecurity landscape and emerging threats; the status of ongoing cybersecurity initiatives and strategies; incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. The Greystone affiliate's Chief Information Security officer and Information Security Committee (made up of key information technology personnel) are responsible for establishing, maintaining, and monitoring the cybersecurity ecosystem at the Greystone affiliate. The Chief Information Security Officer and Information Security Committee together have over 25 years of experience in information technology managed services systems and cybersecurity.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: We face a number of cybersecurity risks in connection with our business. Although we maintain and enforce our Cybersecurity Program, we may not detect or prevent all attempts to compromise our systems or otherwise cause breaches or disruptions, which could result in material impacts to our operations or financial condition. As of the date of the filing of this Annual Report on Form 10-K, we are not aware of any material impact to our results of operations or financial conditions resulting from cyberattacks or other information security breaches. For more information about the cybersecurity risks we face, see the risk factor entitled "We could be the target of a significant cyber-attack, threat or incident that impairs internal systems, results in adverse consequences to information our system process, store or transmit or causes reputation or monetary damages as a consequence" in Item 1A - Risk Factors.

companyName: Virtu Financial, Inc.

ticker: VIRT


text: The goal of the Company's information security program is to manage risks in a prioritized fashion; however, control gaps and/or their related control effectiveness, resource constraints, and execution failure can pose cybersecurity risk to the Company. In the event of a cyber incident, the Company has a process in place whereby the information security team will alert the appropriate levels of management, as well as the legal and finance departments so that the materiality of any such event can be determined.

companyName: LIVEPERSON INC

ticker: LPSN


text: Information security is the responsibility of our Information Security and Compliance department, overseen by our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). We leverage a combination of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, NIST Security and Privacy Controls for Information Systems and Organizations, International Organization for Standardization ("ISO 27001"), the American Institute of Certified Public Accountants ("AICPA) SOC 2 set of security controls, and Center for Internet Security best practice standards to measure our security posture and manage risk. We implement both preventative and detective mechanisms, as well as processes, controls, and tools in layers. These layers include applications, systems, network, third-parties, personnel and physical security. We implement this system via governance, risk management, policy, education, security engineering, security compliance, security operations, and application security.

companyName: INSTRUCTURE HOLDINGS, INC.


text: identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: JUPITER NEUROSCIENCES, INC.

ticker: JUNS


text: The Board of Directors, as a whole, has overarching responsibility for overseeing our strategic and operational risks. The Audit Committee specifically monitors risk management, including cybersecurity threats. Management, led by the Vice President, Information Systems and Technology, regularly reports to the Board of Directors, primarily through the Audit Committee, providing an annual report on specific risks, mitigation efforts, and a review of Nordson's cybersecurity maturity.

companyName: NORDSON CORP

ticker: NDSN


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: AGL Private Credit Income Fund


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include including firewalls, data loss prevention, email filtering for ransomware, proactive thread-hunting, cloud-based backups, multifactor authentication, encryption software, intrusion testing and SIEM networking monitoring to ensure the integrity of our data and systems. In addition, we maintain recovery and other business continuity procedures, including cloud-based backups, electrical generators, critical systems housed at hardened data centers and geographic redundancy, intended to minimize disruptions to our operations in the event of disaster or other interruptions to our information systems. Our security events are logged to a central source and monitored by a third party security operations management provider.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: TREES Corp (Colorado)

ticker: CANN


text: We ae not conducting significant operations, so cybersecurity threats have not affected our business strategy or results of operations and the Board of Directors will assess the potential threat to future operations as such operations develop. The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity. help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity.

companyName: NP Life Sciences Health Industry Group Inc.

ticker: ACATD


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our information technology ("IT"), security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.

companyName: QVC INC

ticker: QVCD


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats (including but not limited to malware, ransomware, and social engineering attacks), password hygiene and incident reporting processes.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls. We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards. To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers, potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement. Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: The Cybersecurity Committee receives regular reports from our Chief Information Officer ("CIO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO periodically reports to the Board of Directors regarding cybersecurity risks and our cybersecurity risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. See "Item 1 A. Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: Included among the members of both the Board and the Audit Committee are directors with substantial expertise in cybersecurity matters, and Board members actively engage in dialogue on the Company's information security plans, and in discussions of improvements to the Company's cybersecurity defenses. For example, a member of our audit committee has recently completed executive training at MIT in artificial intelligence and was a former chief executive officer and director of a publicly listed global software company that has an array of products including compliance and cybersecurity related software. He also served as the chair of the compliance and risk committee (including cyber security) at another public company. Additionally, another member of our audit committee recently completed an online course on boardroom governance in cybersecurity. When, in management's or the Board's judgment, a threatened cybersecurity incident has the potential for material impacts, management, the Board and applicable committees of the Board will engage to assess and manage the incident.

companyName: NCR Atleos Corp

ticker: NATL


text: • The EVP, Customer Experience, Solutions and Services of Duke Energy has gained cybersecurity experience through focusing on transmission and the development of long-term grid strategies and solutions and through a prior role as Chief Distribution Officer, overseeing the safe, reliable, and efficient operation of Duke Energy's electric distribution systems, and through serving on the board of the Association of Edison Illuminating Companies. • The EVP and Chief Commercial Officer of Duke Energy has cybersecurity experience gained through responsibility for enterprise technology and security, among other areas. • The CSISO of Duke Energy has over 25 years of experience building and leading security teams within multiple industries. The CSISO holds a Secret Security clearance and is committed to strengthening U.S. critical infrastructure through active collaboration with federal partners at the Federal Bureau of Investigation, Department of Energy, Department of Homeland Security, and state partners including the national guard, law enforcement and universities. • The CIO of Duke Energy has over 25 years of experience in delivering secure information technology solutions across multiple industries, leading technology delivery for all core business functions. The CIO holds a Secret Security clearance and has active interactions and partnership with the Federal Bureau of Investigation, Edison Electric Institute and State Fusion Centers in the jurisdictions that Duke Energy serves.

companyName: PROGRESS ENERGY INC


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a review of the relevant service provider's operational and cybersecurity controls. The Sponsor's officers review and report the results of this annual review and any incidents or perceived risks to the Board of Directors.

companyName: World Gold Trust

ticker: GLDM


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2023 Annual Report on Form 10-K.

companyName: GoHealth, Inc.

ticker: GOCO


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan and policy, incident detection and response, maintaining a vulnerability management policy, maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, maintaining network security controls, access controls, and physical security measures, asset management, systems monitoring, conducting proactive privacy and cybersecurity reviews of systems and applications, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and implement appropriate changes and encrypting Information Systems and Data. In addition, we maintain cybersecurity insurance.

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Our Chief Information Security Officer ("CISO") provides oversight and direction for the Program, including recommending adjustments in response to changes in technology, internal and external threats, business operations, and regulatory and statutory requirements, coordinates with other corporate functions and business segments to address various aspects of the Program managed by technology and operational personnel, an d communicates Corebridge's information security risk posture to relevant personnel, senior management and governing bodies, including as further described below.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Our CEO and CFO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include ensuring routine briefings from internal security personnel, obtaining threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and providing Company personnel with alerts and reports produced by security tools deployed in the IT environment.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CISO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Vice President of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. Our CISO has over 25 years of cybersecurity and corporate risk management experience. The Cybersecurity Steering Committee meets and receives quarterly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are integrated into the day-to-day activities of the Partnership's information technology function led by our Chief Information Officer, who operates under the supervision of our Chief Financial Officer. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).

companyName: CVR PARTNERS, LP

ticker: UAN


text: Our Executive Vice-President and Chief Financial Officer ("CFO") is primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our CFO has assistance from service providers, other consultants and third parties. Our CFO has served as an executive officer for three years and prior to this was an audit and advisory partner at a public accounting firm overseeing financial statement audits of public and private companies. Audit procedures performed for his clients included evaluating internal controls and risk assessment evaluations over information technology and cybersecurity policies.

companyName: Empery Digital Inc.

ticker: EMPD


text: The Board of Directors of the Company (the "Board") is presented with a cybersecurity update quarterly which is integrated within our TriMas Incident Response Plan. The Board reviews the Company's ERM process, including the design of the program, the key risks identified and the actions identified to manage and reduce those risks. Consistent with this undertaking, the Board regularly reviews the Company's cybersecurity strategy and activities in support of the strategy. As part of its compliance oversight responsibilities, the Audit Committee of the Board (the "Audit Committee") is responsible for the review of compliance with laws, regulations and internal policies and procedures of our information and cybersecurity programs. The Board and the Audit Committee receive updates from management quarterly on information and cybersecurity status and enhancements. Additionally, prompt notification of the Board is integrated into the Incident Response Plan.

companyName: TRIMAS CORP

ticker: TRS


text: During the year ended December 31, 2023, there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect the Corporation.

companyName: ENB Financial Corp

ticker: ENBP


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the headings "General Risks – We could be affected by cyberattacks or beaches of our information systems, any of which could have a material adverse effect on our business" and "General Risks – A failure of our information technology infrastructure, information systems, networks or processes may materially adversely affect our business" in this Annual Report.

companyName: QXO, Inc.

ticker: QXO


text: Our Board of Directors and executive officers are responsible for oversight of our information technology framework, including cybersecurity, information security, information technology and business continuity. The Chief Information Officer ("CIO") and other members of senior management report to the Board of Directors and executive officers at least annually and on an as needed basis. In the event of an immediate cyber threat to our business operations, the CIO would promptly initiate the Company's incident response plan including notifying executive officers, Board of Directors and regulators.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: As part of the above processes, we engage with assessors, consultants, auditors and other third parties, including by (i) engaging third-party managed security services to assist with the operation of certain aspects of our cybersecurity program, (ii) engaging security assessment services to provide assessments on our cybersecurity program, (iii) engaging an incident response retainer service to provide timely cyber incident response support and digital forensics analysis services, (iv) engaging risk monitoring services to help identify emerging cybersecurity risks, and (v) engaging with other information technology and legal subject matter experts to review our cybersecurity program to help identify areas for continued focus, improvement, and/or compliance.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: We are a blank check company whose business purpose is to effect a merger, capital stock exchange, asset acquisition, stock purchase, reorganization or similar business combination with one or more businesses or assets. We have no significant operations. Therefore, while management monitors our exposure to cybersecurity risk, we have not adopted specific processes for assessing and managing such risk. The audit committee is generally responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. We have not encountered any cybersecurity incidents since our initial public offering. However, sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data. As an early stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. See Item 1A. Risk Factors, "Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption and/or financial loss" of this Annual Report for a discussion of cybersecurity-related risks.

companyName: CONX Corp.


text: Both management and the Board are actively involved in the oversight of risks from cybersecurity threats. TPL's information security program is designed to ensure that management and the Board are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Third-party risk management processes exist to minimize the material cybersecurity risks associated with our use of third-party suppliers, vendors and service providers. Cybersecurity risks, cyber risk ratings, cybersecurity program maturity and potential fourth-party risks are typically considered when selecting and performing oversight of third-party service providers. While we are in the process of increasing the resiliency of these processes across the board, our control over and ability to monitor the security posture of third-party vendors and service providers remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: Canoo Inc.

ticker: GOEVQ


text: The Company is committed to complying with all applicable cybersecurity regulations and standards. We regularly review our cybersecurity practices to ensure they align with industry best practices and regulatory requirements.

companyName: HG Holdings, Inc.

ticker: STLY


text: Our CIO and our VP of Information Security are both experienced cybersecurity executives. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.

companyName: SCANSOURCE, INC.

ticker: SCSC