text: We recognize the importance of developing, implementing, and maintaining strong cybersecurity measures to help maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: Neurogene Inc.

ticker: NGNE


text: Cybersecurity and Risk Management As a financial institution, we are confronted with a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and maintaining customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC

secItem: Item 1C


text: We design our information and systems access restrictions referencing the National Institute of Standards and Technology 800 53R5 and NIST CSF 2.0 Framework and use the supplemental requirements as implementation guidance. Our information security policies and standards are reviewed and updated for new regulatory changes and/or mandates. These standards are applicable to all corporate functions, business units, subsidiaries and controlled affiliates across the enterprise. Annual audits are conducted by internal and external parties to measure compliance and adherence to the standards.

companyName: STATE STREET CORP

ticker: STT


text: Information Security, Corporate Audit, Finance, Legal, Compliance and Investor Relations have a strong partnership at the management level and have established a Cybersecurity Council that connects the risk management and cybersecurity incident response processes. In the event of a cybersecurity breach, the ISO will inform the Cybersecurity Council, and then the Cybersecurity Council will determine materiality and next steps. The Cybersecurity Council will meet with the RMC and/or the full Board as needed to share details of the event and facilitate reporting to regulators as required.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: In addition, the company's Enterprise Risk Management Council (ERMC) considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is comprised of the Executive Leadership Team, as well as the Chief Accounting Officer, Chief Ethics and Compliance Officer, Corporate Secretary, Chief Sustainability Officer, Treasurer and Vice President, Internal Audit. The CISO and the CIDO (previously the CIO) attend each ERMC meeting. The ERMC meets during the year and receives periodic updates from the CIDO and CISO on cybersecurity risks. We have an established process governing our response to a cybersecurity incident from detection to mitigation, recovery, assessment, internal and external notifications and functional stakeholder engagements with legal, privacy and risk management, among others. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board (including our Lead Independent Director and the Audit and Risk Committee chair), as appropriate.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: 2FA logins to servers; and Seek to obtain a cybersecurity insurance policy where part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. The Audit Committee members receive presentations on cybersecurity topics from our Director of Information Technology, or external experts as part of the Audit Committee’s continuing education on topics that impact public companies.

companyName: CG Oncology, Inc.

ticker: CGON


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, security monitoring tools, and multi-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including senior management and the Board.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our audit committee, which pursuant to its charter, assists the board of directors with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.

companyName: IAC Inc.

ticker: IAC


text: The Partnership established a Privacy and Information Security Incident Response Plan ("IRP") addressing the identification, communication, and classification of, and the response to, potential cybersecurity incidents and other disruptions of information systems. All investigation and reporting pursuant to the IRP is conducted at the direction of the Partnership's Chief Privacy Officer. Associates are required to report and address any suspicious or inappropriate activity and can leverage a tool to report suspected cybersecurity threats via email. Pursuant to the IRP, once a cybersecurity event is identified, it is ascribed a severity level and/or associated tasks and cases in order to appropriately track and handoff any response and remediation efforts across our teams. The IRP provides for the communication of roles, responsibilities, and on-call escalation paths to communicate incidents to key stakeholders. Information security events are managed by designated teams whose roles and responsibilities are defined to facilitate quick, effective, and orderly responses. The Chief Privacy Officer, in collaboration with the CISO, is required to review the IRP on at least an annual basis, which may include the incorporation of any lessons learned from prior incidents.

companyName: JONES FINANCIAL COMPANIES LLLP


text: Alight recognizes the importance of developing, implementing and maintaining robust cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of the data in our care. The Company utilizes a cross-functional group of colleagues representing various stakeholders including technology, security, finance, internal audit, legal and others to identify and manage risks across the organization, including risks relating to cybersecurity.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our information security program employs a wide variety of technologies that are intended to secure our operations and proprietary information. We have a Business Continuity/Disaster Recovery program in place, which is updated and tested on a regular basis, focused on protecting our networks, systems, data, and facilities from attacks or unauthorized access. We maintain an Incident Response program which describes Synovus' processes, procedures, and responsibilities for responding to cybersecurity incidents. This program is tested regularly through tabletop exercises, including through independent third-party review and assessments at least annually. Each exercise results in lessons learned and subsequent improvements to the Incident Response program. In addition, we have a dedicated Cybersecurity Fusion Center for monitoring and responding to cyber events in real-time.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: To the best knowledge of Management, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the Company's risks related to cybersecurity, see Part I, Item 1A, — Risk Factors for the risk factor "Our businesses may suffer and we may incur substantial costs if we are unable to access our systems and safeguard the security of our data in the event of a disaster, cyber breach or other information security incident."

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Additional information regarding risks from cybersecurity threats is discussed in Part I, Item IA, "Risk Factors," under the heading "Security threats, such as ransomware attacks, to our IT infrastructure could expose us to liability, and damage our reputation and business," which should be read in conjunction with the information herein.

companyName: CarParts.com, Inc.

ticker: PRTS


text: Depending on the information systems and environment, our cybersecurity program includes various administrative, physical, and technical safeguards designed to manage and mitigate material risks from cybersecurity threats, including, for example: an incident response plan, incident detection and response, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, a vendor risk management program, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal. Additionally, we provide all employees, including part-time and temporary employees, with annual and ad hoc cybersecurity awareness training.

companyName: Immunovant, Inc.

ticker: IMVT


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, provides regular updates to the board of directors on our cybersecurity posture, emerging threats and our risk mitigation efforts. Our board of directors is apprised of cybersecurity incidents deemed to have significant business impact, even if they are not material to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: VALHI INC /DE/

ticker: VHI


text: We continuously strive to strengthen our cybersecurity measures to protect our systems and data from evolving threats. To date, cybersecurity incidents and risks have not materially affected us, including our business strategy, results of operations, or financial condition.

companyName: Strawberry Fields REIT, Inc.

ticker: STRW


text: We also have management level committees and response teams who support our processes to assess and manage cybersecurity risk as follows: • The Risk Oversight Committee ("ROC"), whose core members include the CFO, Chief Technology Officer, Chief Product Officer, and General Counsel, is responsible for making risk management decisions to ensure consideration of all relevant factors and alignment with our overall risk mitigation strategy. The ROC also oversees key risk management activity to help ensure accountability, adequacy of resourcing, implementation of Company directives, and alignment of oversight provided by the Board and senior management. • The Technology Security and Privacy Council, co-chaired by the CSO, Chief Information Officer, and Chief Privacy Officer, brings together IT, legal and internal audit personnel, and other function leads. The Security and Privacy Council provides a forum for these cross-functional members of management to consider emerging technologies, such as artificial intelligence and emerging cybersecurity risks; review cybersecurity and privacy regulations; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our ERM program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.

companyName: Regional Management Corp.

ticker: RM


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to the firm's Disclosure Committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the firm's Disclosure Committee with these materiality assessments and any resulting reporting requirements.

companyName: Carlyle Group Inc.

ticker: CG


text: Employee Training We endeavor to provide all employees with data protection training. Employees involved with information protection, privacy and other risk management specialties also engage in specialized role-based training as is practicable. We use a variety of training methods, including computer-based training, role-based training, company intranet awareness campaigns and various simulation exercises.

companyName: Chubb Ltd

ticker: CB


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: We have implemented a comprehensive cybersecurity program designed to protect the confidentiality, integrity, and availability of our information systems and data. The program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and zero trust model, incorporates industry best practice standards, and includes policies, standards, procedures, controls and technology platforms that help manage cybersecurity risk.

companyName: nVent Electric plc

ticker: NVT


text: Risks identified through our cybersecurity program are assessed to determine the potential impact and likelihood of occurrence and mitigation plans are developed and implemented accordingly.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: Management's Role—The Company's Chief Information Officer is responsible for the Company's cybersecurity team and for reporting to the Audit Committee of the Board of Directors. The Company's corporate security team reports directly to the Chief Information Officer. Our Chief Information Officer has more than thirty years of experience managing communications networks, data centers, information technology teams, systems administration, and cybersecurity in the media and advertising industry. Our corporate security team is similarly composed of seasoned professionals with significant experience in the field. The Chief Information Officer regularly informs the Company's senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The corporate security team has a broad range of experience selecting, deploying, and operating cybersecurity technologies initiatives and seek to ensure that each team stays educated on emerging technologies and threats.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Our cybersecurity program is implemented and maintained by Pure's Global Information Security Office (GISO), a team of security professionals responsible for developing and implementing an information security program designed to protect our assets, including data, networks, applications and people, from cyber threats. The GISO includes individuals with expertise in the following areas and who continue to leverage such expertise at the company in the following manners: • Governance, Risk & Compliance (GRC). Maintaining cybersecurity policies, standards, and processes as well as providing training to our employees on them. • Security Operations. Monitoring our critical systems and assets to identify and respond to security incidents in a timely manner. • Security Engineering & Architecture. Implementing risk-based security controls. • Product Security. Supporting our product teams' security objectives by providing design review, certification management, penetration testing, and consulting services, as well as operating security vulnerability management and reporting dashboard capabilities. • Enterprise resiliency. Developing policies, procedures and practices for critical operations recovery and business continuity in the event of a cybersecurity incident.

companyName: Everpure, Inc.

ticker: PSTG


text: In support of our cybersecurity risk management program, we have adopted an Information Security Policy and Incident Response Plan. The Information Security Policy and Incident Response Plan establishes a comprehensive guide of controls and operating procedures to enable internal and external teams to prepare, detect, contain, and recover from cybersecurity incidents. Our cybersecurity risk management program also includes: • Cybersecurity risk assessments to evaluate our readiness if certain risks were to materialize; • Individuals, including management, employees, and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • The use of external service providers and tools, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response planning and testing, and management; and • Third-party risk management processes for service providers, suppliers, and vendors.

companyName: Greenidge Generation Holdings Inc.

ticker: GREE


text: The Global Corporate Continuity Program is generally overseen by the Business Recovery Governance Committee ("BRGC"). BRGC has developed certain policies and principles in implementing the program. The executive officers of the Sponsor perform certain functions with respect to the Trust and the Fund that, if the Trust or the Fund had directors or executive officers, would typically be performed by them, including receiving reports regarding the Global Corporate Continuity Program. In line with the Global Corporate Continuity Program, the Sponsor or its delegate: (1) regularly conducts a business impact analysis; (2) develops, exercises and maintains a viable and actionable Business Continuity Plan specifically tailored to the Sponsor in light of the nature and scope of its business; and (3) completes annual testing of the Business Continuity Plan. Material exceptions to this policy and risk events and related mitigation/corrective measures are reported to the Sponsor's Governance Oversight Committee. As appropriate, the Sponsor or its delegate will coordinate with FRI's relevant risk management and disaster recovery-related committees to review risk monitoring and mitigation strategies as contemplated under the Global Corporate Continuity Program at least annually, and more often if there are significant internal or external changes affecting these risks as pertains to the Sponsor's business and its Business Continuity Plan.

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: As part of its cybersecurity program, BancPlus has established comprehensive incident response and recovery plans in the case of a cybersecurity incident and continues to regularly test and evaluate the effectiveness of those plans. The Company's incident response and recovery plans address and guide its employees, management, and the BancPlus board of directors on responses to a cybersecurity incident.

companyName: BANCPLUS CORP


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management processes and managed by a cross-functional team, comprised of IT leadership, Internal Audit and Legal. Our IT leadership team is comprised of our Chief Information Officer and Vice President of Information Technology and Security, each with over two decades of experience in information technology and cybersecurity. Our processes are designed to create a comprehensive, cross-functional approach to identify and mitigate cybersecurity risks as well as to prevent cybersecurity incidents in an effort to support business continuity and achieve operational resiliency. The Audit Committee of the Board of Directors has overall oversight responsibility for data security practices and controls to monitor and mitigate the Company's technology risk exposure.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our board of directors, our audit committee regularly interacts with, and receives reports from, our management, the Manager, Apollo, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM ' s CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo ' s peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Company's Information Systems Department is in charge of network construction and cybersecurity management. If a system failure, serious accident, or sign of such an accident is detected, the Information Systems Department reports to the CEO and other executives, who then consider countermeasures. The following are considered important cybersecurity issues, and countermeasures are being implemented.: Malware

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: The Board and the Security & Technology Committee also receive prompt information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: The potential impact of risks from cybersecurity threats on the Trust is assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Trust has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Trust believes have materially affected, or are reasonably likely to materially affect, the Trust, including its business strategy, operational results, and financial condition.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: We have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: Our Board of Directors addresses the company's cybersecurity risk management as part of its general oversight function. Our Audit Committee is responsible for overseeing the company's cybersecurity risk management program, including mitigation of risks from cybersecurity threats. In addition, we have established an Executive Security Council (ESC). The ESC oversees and governs our cybersecurity program.


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. Please refer to "Any significant interruption in the operation of our business functions, facilities and systems or our vendors' facilities and systems could result in a materially adverse effect on our operations" and "Any significant breach in our data security infrastructure or our vendors' facilities and systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach" under Item 1A Risk Factors.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board receives regular updates regarding the Audit Committee's activities.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: The Cybersecurity Department outsources several cybersecurity defense measures to utilize the know-how and tools, including artificial intelligence, of industry leading companies. The Cybersecurity Department also proactively consults with specialists in a variety of cybersecurity disciplines to review the Company's information systems for cyber risks and to provide advice for remediating areas of concern, as well as for implementing preventative measures to improve the Company's defenses.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: In the event of a cybersecurity incident, we have established incident response protocols to facilitate timely detection, containment, and remediation. Additionally, we maintain business continuity and disaster recovery plans to minimize the impact of cyber incidents on our operations and stakeholders.

companyName: GSE SYSTEMS INC


text: As of the date hereof, the Company has not encountered cybersecurity incidents that the Company believes to have materially affected or are reasonably likely to materially affect the Company taken as a whole, including its business strategy, results of operations or financial condition.

companyName: Energy Services of America CORP

ticker: ESOA


text: Emerson has a cybersecurity risk management program that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. Emerson maintains oversight of its cybersecurity risk management program through a governance structure that includes senior management, the Audit Committee and the Board of Directors (the "Board"). Emerson's cybersecurity risk management program leverages multiple layers of security controls across the Company's systems designed to establish risk treatment plans and regularly monitor risks. Emerson maintains cybersecurity policies and standards aligned with industry standard control frameworks and applicable regulations, laws and standards, and a global incident response plan.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters and reports up to the full Board of Directors. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures.

companyName: MARINUS PHARMACEUTICALS, INC.


text: We have established a comprehensive incident response plan to swiftly address and recover from cybersecurity incidents, minimizing operational impact. We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats. Biannual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures. Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.

companyName: Inogen Inc

ticker: INGN


text: To date, we have not identified any cybersecurity threats or incidents that have had or are likely to have a material impact on our business, financial condition or results of operations. Nonetheless, the escalation of cybersecurity threats poses a risk to our systems, networks and products and services, which, despite our efforts to mitigate these risks, may not protect against all incidents. For a detailed discussion on how cybersecurity risks could materially impact our business, see "Part I, Item 1A — Risk Factors."

companyName: EZCORP INC

ticker: EZPW


text: The Audit Committee of our Board ("Audit Committee") is responsible for the oversight of cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats, and incidents. Multiple times per year, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes, covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials, including a cybersecurity scorecard and other materials, indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Vice President of IT, who is responsible for cybersecurity. Members of the Audit Committee also regularly engage in ad hoc conversations with management on cybersecurity-related matters and news events and discuss any updates to our cybersecurity risk management and strategy programs. When incidents occur, depending on the nature and severity, the Audit Committee Chair is notified immediately, and incidents are further reviewed periodically with the Audit Committee. Material cybersecurity matters are also periodically reviewed with the full Board of Directors.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: if necessary, the use of third-party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: FUEL TECH, INC.

ticker: FTEK


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on an annual basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.

companyName: XCEL ENERGY INC

ticker: XEL


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors— Risks Related to our Company and an Investment in our Shares—We may face a breach of our cyber security, which could result in exposure of confidential information and adverse consequences to our operations."

companyName: Apollo Infrastructure Co LLC


text: Our approach to cybersecurity risk management includes: • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;

companyName: SMITH A O CORP

ticker: AOS


text: As the workforce, the work environment and the threat landscape continue to evolve, the Company seeks to evaluate related risks and implement appropriate controls.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We depend on the digital technologies of third parties, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Chenghe Acquisition II Co.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy; incident detection and response tools; risk assessments; encryption of certain data; segregation of certain data; network security controls; access controls; asset management, tracking and disposal; employee training; and monitoring of certain systems. We also have cybersecurity insurance.

companyName: Landos Biopharma, Inc.


text: We maintain comprehensive programs and technologies to ensure that our information systems are effective and prepared for data privacy and cybersecurity risks, including regular oversight of our security programs for monitoring internal and external threats to ensure the confidentiality and privacy of our data. As the volume and complexity of cyberattacks continue to evolve, we continue to enhance our security capabilities by continued investment in cyber technologies, further developing our internal cybersecurity personnel and educating our workforce regarding cybersecurity, and leveraging emerging technologies.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Notwithstanding our efforts at cybersecurity, no system of prevention is impenetrable, and we cannot guarantee that we will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, the Company has not detected any material cybersecurity incident to our own systems. However, during the second quarter of 2023, a prominent third-party vendor experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer. For further information regarding this incident, please see our Quarterly Report on Form 10-Q for the quarter ended June 30, 2023 filed on August 10, 2023 and our Quarterly Report on Form 10-Q for the quarter ended September 30, 2023 filed on November 9, 2023. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, or financial condition.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: As part of our overall risk management approach, we recognize the importance of identifying and managing cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our Chief Information Officer ("CIO") and Chief Operations Officer ("COO"), with input from our Chief Information Security Officer ("CISO").

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Our Board of Directors oversees and guides our business and oversees our exposure to major risks. As stated in its charter, our Board of Directors has delegated to the Audit Committee, which currently includes the Board members with cybersecurity acumen, the responsibility for Board-level oversight of cybersecurity risk. As part of its oversight role, the Audit Committee receives reports about our protocols, material threats or incidents and other developments related to cybersecurity.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: In addition, the Evergy Companies review many third parties with whom the Evergy Companies do business to understand and evaluate potential cybersecurity risks of engaging the third party and work with the third party to appropriately mitigate identified risks, as needed. Among other measures, certain third parties are required to have processes in place to mitigate risk that data would be compromised, to become aware of cybersecurity incidents and/or to promptly notify the Evergy Companies of any cybersecurity incidents. Generally, the Evergy Companies retain the right to perform an assessment, audit, examination or review of all controls in the third parties' environment to monitor compliance with applicable cybersecurity agreements. The Evergy Companies may decide not to move forward with a third party that does not meet security requirements.

companyName: Evergy, Inc.

ticker: EVRG


text: The risks from cybersecurity threats are monitored and managed by the Company's information systems team members who have relevant expertise with such potential threats, and who operate in collaboration with other Company functions. The Company's Audit Committee is responsible for overseeing cybersecurity risk and is informed in a timely manner of any incidents considered potentially serious, together with details on the prevention, detection, mitigation and remediation of such incidents.

companyName: Cannabist Co Holdings Inc.

ticker: CBSTF


text: Identifying and assessing cybersecurity risks and threats are integral components of our broader enterprise risk management strategy. Our information technology leadership, with input from senior management, is responsible for defining our cybersecurity strategy, setting priorities, and driving the execution of our cybersecurity initiatives. We maintain a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of our information systems, including the information residing on our systems. We utilize the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to guide our efforts, aligning with industry standards.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated responsibility for the periodic review and evaluation of the Company's policies and programs for identifying cybersecurity risks to the Audit Committee. In addition, the entire Board receives quarterly updates on the Company's cybersecurity action plans and annual reports containing full cybersecurity control assessments and action plans from senior management, and periodically reviews information regarding the Company's cybersecurity risks. We have an Information Technology Steering Committee ("ITSC"), comprised of the Company President and Chief Executive Officer, the Executive Vice Presidents of our Vegetation Management and Industrial Equipment Divisions, the Chief Financial Officer, and the Chief Sustainability Officer, that assesses and manages material risks from cybersecurity threats and determines the priority of cybersecurity initiatives. The ITSC also reviews the Board's and Audit Committee's feedback and incorporates it into ongoing cybersecurity management efforts.

companyName: ALAMO GROUP INC

ticker: ALG


text: Cybersecurity risk management is an integral part of our enterprise risk management strategy, which is overseen by the Board. Cybersecurity is critical to maintaining the trust of our customers and business partners, and we are committed to protecting our and their confidential and sensitive information and to mitigating cybersecurity risks that impact our systems and networks. In order to respond to the threat of security breaches and cyberattacks, we have developed a program, overseen by our Chief Technology Officer, that is designed to assess, identify, and manage material risks from cybersecurity threats. Our information security program is focused on protecting and preserving the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company.

companyName: EXP OldCo Winddown, Inc.


text: Our management is responsible for implementing our security program, which is overseen by our Security Governance Council (the "SGC") that regularly reports to our Chief Executive Officer and Audit Committee. The SGC is chaired by our CISO and is comprised of senior leaders and key personnel throughout the Company to support cross-functional representation. The members of the SGC are comprised of our executives and managers who understand our business operations, including but not limited to individuals from the following departments: Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management. The SGC meets on a quarterly basis with the mission to develop, coordinate, and sustain the organization's enterprise security program; coordinate and respond to security risks and incidents; and develop, implement, and maintain the organization's enterprise security strategy in alignment with, or in support of, business goals and objectives. The recommendations of the SGC are considered when updating the information security policies, procedures, and standards at Paychex.

companyName: PAYCHEX INC

ticker: PAYX


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed to leverage certain information security standards, such as those issued by the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adapt and mitigate new threats, leverage of internal team resources to focus on business priorities, and addressing evolving regulatory requirements. Our response plans require prompt notification to the Information Security Group in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching; and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We maintain our company data and communication services with a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program (the Chief Risk & Resiliency Officer) sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.

companyName: MOODYS CORP /DE/

ticker: MCO


text: While often viewed as a technical discipline, we approach cybersecurity as a corporate governance responsibility that involves risk management, reporting controls, testing, and training, and executive accountability. Our motto is that every member of our organization is a member of our security team, a mantra that is driven as part of Customers' overall culture.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: In the event that management identifies significant risk exposures with respect to cybersecurity, it will present such exposure to our Audit Committee. Our Cyber Security Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. This would include notifying the appropriate individuals, investigating the incident, evaluating materiality, and responding to the incident. We have in the past and may continue to retain outside legal counsel, where necessary, to guide incident response efforts and perform a confidential and privileged review of the facts and circumstances surrounding suspected or confirmed cybersecurity incidents. If an incident were to occur, the Company may engage other service providers, where needed, to assist with the collection of forensic artifacts and perform additional procedures necessary to resolve and report any material cybersecurity incidents. Although we have cyber insurance and believe that our cybersecurity processes and controls are adequate, cybersecurity risk has increased due to remote access and increased sophistication of cybersecurity adversaries, as well as the increased frequency of malware attacks. As such, technology failures or cybersecurity breaches could still create system disruptions or unauthorized disclosure or alterations of confidential information and disruptions to the systems of our third-party suppliers and providers.

companyName: WARRIOR MET COAL, INC.

ticker: HCC


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Business Officer who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: The Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who holds a degree in Management Information Systems (MIS) and a Certified Information Security Manager (CISM) designation, and has more than 20 years of IT, cybersecurity, audit and risk management experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating cybersecurity priorities and the status of key initiatives.

companyName: CUMMINS INC

ticker: CMI


text: Information Security Officer • 18 years' experience in banking. With emphasis in fields as Merchant Service Provider, Electronic Banking, Security, IT-Help Desk, BSA, Vendor Management, Internal Audits with Compliance Officer. • 10 years (2006-2016) of work and experience in Disaster Risk and Business Continuity Planning, along with Incident Response Planning. Formulated Continuity Planning and Disaster Recovery Plans for the Financial Institution with 8 Branches. • 4 years as Merchant Services Provider, ensuring more than 400 merchant card terminals were uploaded to PCI Compliance Standards for Security at the merchant level. • 3 years of Branch Incident Security monitoring including security video monitoring and reporting of incidents.

companyName: CapStar Financial Holdings, Inc.


text: We are committed to using technology to improve our competitive position. We depend on a variety of information systems and technologies (including cloud technologies) to manage the operations of our growing customer base. Our core business systems consist mostly of purchased and licensed software programs that integrate together and with our APP.

companyName: Karbon-X Corp.

ticker: KARX


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.

companyName: VALHI INC /DE/

ticker: VHI


text: Our Audit Committee has primary responsibility for overseeing our risk-management program relating to cybersecurity, although our Board of Directors participates in periodic reviews and discussion dedicated to cyber risks, threats, and protections.

companyName: Synergy CHC Corp.

ticker: SNYR


text: We have a global information security program responsible for creating cybersecurity policies, including an overarching Global Information Security Policy, that takes into account the National Institute of Standards & Technology Cybersecurity Framework ("NIST CSF") and regulatory requirements. Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of our layered cybersecurity measures, which include a documented security architecture program, endpoint detection, security incident response and event management and recovery, and privileged access management, among others.

companyName: Aramark

ticker: ARMK


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Our cybersecurity team collaborates with stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies. Our risk management program also assesses third-party cybersecurity risks and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers.

companyName: Journey Medical Corp

ticker: DERM


text: The data centers have established incident response procedures to detect, investigate, and mitigate security incidents promptly. This includes a dedicated security incident response team (SIRT) that coordinates response efforts and communicates with us.

companyName: AIRWA INC.

ticker: YYAI


text: The information security team, under the authority of the CSO, has developed a cybersecurity risk management program that addresses four primary operational pillars: • researching, monitoring and identifying significant cybersecurity threats and risks across Akamai and the larger internet ecosystem taking into account malicious actors, software vulnerabilities and other threat sources; • assessing designated risks applicable to Akamai's assets and systems, including those associated with third-party vendors and suppliers, and planning and tracking efforts to address significant risks; • managing cybersecurity incidents and associated reporting and communications obligations; and • ongoing compliance assessments through internal and external audits and assessments, certifications and the penetration and vulnerability testing of certain systems. These operational pillars and the programs established from them are informed by cybersecurity industry standards.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our CIO, CISO, General Counsel, Division Presidents, CFO and/or Chief Executive Officer (collectively, "Senior Management") and, in the instance of product cybersecurity, our E-Systems Safety Committee. Senior Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.

companyName: LEAR CORP

ticker: LEA


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee and technology committee of our board of directors are responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Our cybersecurity program is designed and implemented to assess, identify, mitigate and manage risks from cybersecurity threats that may result in adverse effects on the integrity and availability of our production and information systems. Among other items, our cybersecurity program is comprised of policies, standards, plans and frameworks for information security, business resilience, insider threat mitigation, technology asset management, cyber risk management, incident response and procurement. Material risks from cybersecurity threats include, among other things, operational disruption, including failure to meet our service level agreements, loss or destruction of data, hardware or intellectual property, and cyber extortion through ransomware. The management of cybersecurity risks, which involves significant and sustained resource commitments and management attention, is also integrated into the Company's enterprise risk management program through formal processes that help identify and elevate the most serious risks, including those pertaining to cybersecurity, for management at the enterprise level and oversight at the Board level. For more information on the Company's cybersecurity risks and their possible impact on our business strategy, results of operations, or financial condition see "Risk Factors – Cybersecurity and Technology Risk Factors" in Part I, Item 1A of this Form 10-K.

companyName: VERISIGN INC/CA

ticker: VRSN


text: We have in the past been, and may in the future be, the target and victim of cybersecurity attacks. In general, security incidents have increased in sophistication and have become more prevalent across industries and may occur on our systems, or on the systems of third parties we use to host our solutions or SaaS solutions that we use in the operation of our business, or on those third party hosting platforms on which our customers' host their systems. Although we have taken significant measures to detect, effectively remediate, and prevent phishing and other attacks and security threats, we cannot be certain that our efforts will be effective to prevent and remediate all attacks and security threats. To date, we do not believe we have experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See the "Risk Factors" section of this Annual Report for more information on material cybersecurity risks that we face.

companyName: Dynatrace, Inc.

ticker: DT


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Executive Director – Corporate Product Cybersecurity and Functional Safety to review the cybersecurity program, including risks and the status of key initiatives.


text: Management is responsible for designing and implementing our governance framework and controls for managing our material risks from cybersecurity threats, under the oversight of our Board of Directors. Our Chief Information Security Officer is responsible for assessing and managing identified cybersecurity risks, evaluating and remediating cybersecurity incidents, and sharing information directly with the Audit Committee and Technology Committee, or full Board of Directors, when appropriate. Our Chief Information Security Officer reports to our Chief Information Officer, who is in turn responsible for the management of Humana's data and information technology risks more generally. Our Chief Information Officer is a senior executive with more than two decades of experience leading technology teams in large, regulated industries. Our Chief Information Security Officer is an experienced cybersecurity executive and leader in the field, with many years of relevant experience working in highly regulated industries.

companyName: HUMANA INC

ticker: HUM


text: We review and test our information technology system on an as-needed basis and also utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.

companyName: Vestand Inc.

ticker: VSTD


text: Role of the Board The Board has delegated to the Audit Committee of the Board (the "Audit Committee") primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to TPL's risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from TPL's Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Ms. Duganier holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

companyName: Sharplink, Inc.

ticker: SBET


text: The Company is committed to transparency and robust risk management, therefore we prioritize the protection of our stakeholders' interests, including safeguarding sensitive information from cybersecurity threats. Our approach to cybersecurity risk management encompasses a comprehensive process of assessment, identification, and mitigation strategies. Initially, we conduct thorough assessments to identify potential vulnerabilities and threats within our systems and infrastructure. These assessments are followed by rigorous identification procedures and testing aimed at pinpointing material risks that could compromise the integrity of our operations or the confidentiality of our data. Once identified, we employ a multifaceted approach to managing these risks, which includes implementing cutting-edge technological solutions, enforcing stringent access controls, and providing ongoing training and awareness programs to our employees. Moreover, we maintain open lines of communication with relevant stakeholders, ensuring timely response and adaptation to emerging cyber threats.

companyName: KwikClick, Inc.

ticker: KWIK


text: Further, our Vendor Code of Conduct addresses our expectations with respect to data security. When our Procurement group processes a vendor relationship involving information systems, various groups will review the vendor and its systems for potential data security-related issues and risks associated with using the tools, technology, data processing and other services of such vendor. Our contracts include terms that help address the safeguarding of our data.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Board receives periodic reports from management on our cybersecurity threats, incident preparedness, mitigation strategies, and related cyber risk management program enhancements. Board members also receive presentations on emerging topics in cybersecurity risk and regulation from our Chief Digital Officer ("CDO") as part of the Board's continuing education on topics that impact public companies. In addition, management is prepared to update the Board, as it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: The Audit Committee of the Board of Directors oversees our cybersecurity program and management of the associated risks. The Audit Committee periodically receives presentations and reports on cybersecurity risks on a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Audit Committee also receive reports regarding cybersecurity incidents that meet established reporting thresholds through the process described above, as well as updates regarding any such incident.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our Chief Digital and Information Officer ( CDIO), our CISO, and senior members of our information security group are responsible for identifying, assessing, and managing risks from cybersecurity threats. Our CISO, who manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security group and through internal escalation procedures, reports to the CDIO, who reports directly to our Chairman, President, and Chief Executive Officer.

companyName: LOWES COMPANIES INC

ticker: LOW


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our audit committee is also designated to receive prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Hyperfine, Inc.

ticker: HYPR


text: The Company maintains a formal information security training program for all employees that includes training on matters such as phishing and email security best practices. Employees are also required to complete mandatory training on data privacy.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: In the event of a cybersecurity incident, our incident response team, composed of members of our information security team as well as other key personnel, identifies, evaluates, and quantifies the relevant risks based on the available information and classifies the severity of the cybersecurity incident based on the level of risk to the Company. Our incident response measures include procedures to provide incident updates and developments to our senior management and the Board of Directors in the event of an ongoing cybersecurity incident. We also maintain an information security risk insurance policy. We conduct internal exercises to prepare our leadership and cross-functional teams to respond in the event of a cybersecurity incident and to help us test and consider revisions to our incident response procedures. We also actively engage with key consultants, auditors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program. Our program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board of Directors. To date, we have not experienced any cybersecurity threats or incidents which have materially affected or are reasonably likely to materially affect the Company.

companyName: XPO, Inc.

ticker: XPO


text: We maintain policies and have established processes involving our IT security, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.

companyName: DAVITA INC.

ticker: DVA


text: We operate in the advertising technology sector, which is subject to various cybersecurity threats and risks that could adversely affect our business, financial condition, and results of operations, including unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems; theft of sensitive, regulated, or confidential data including personal information and intellectual property; the loss of access to critical data or systems through ransomware, destructive attacks or other means; business delays, service or system disruptions or denials of service; violation of privacy laws; and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is in alignment with a combination of industry standards and best practices, such as ISO 27001, Center of Internet Security ("CIS") for our information systems, and the Open Web Application Security Project ("OWASP") Top 10 for our website and mobile applications. We conduct regular internal and annual external penetration testing of our cloud hosting environment to identify our top information security risks. In addition, we perform ad hoc risk assessments to identify the potential impact and likelihood of various cyber scenarios and to determine appropriate mitigation strategies and controls.

companyName: AdTheorent Holding Company, Inc.


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Operating Officer (COO). She has over 30 years of experience in leading information systems management, strategy, and operational execution, including incident management, prevention, and response. Our Senior Director of Global Information Security (ISD) reports to our CIO and is responsible for the protection and defense of our networks and systems and managing cybersecurity risk. He has over 20 years of experience in managing cybersecurity and related risks, including threat identification, incident response, and defense strategies. Our CIO and ISD are supported by a direct and cross-functional team of professionals with broad experience and expertise in threat assessment and detection, mitigation technologies, training, incident response, and regulatory compliance.

companyName: SMITH A O CORP

ticker: AOS


text: We engage and rely upon third parties to provide services and/or goods, represent and or otherwise act on our behalf. Prior to engaging or conducting any business with or on our behalf, such parties undergo a due diligence review, and a third party security risk assessment is conducted to validate they are legally permitted and qualified to maintain appropriate safeguards to protect our information assets in connection with the services they intend to provide.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: The Operations Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the VP IT provides information security updates to the Operations Committee at each scheduled meeting. In addition, as discussed below, we have implemented an Incident Response Plan (IRP) to provide a structured and systematic incident response process for information security incidents that affect any of our information technology systems, network, or data. The IRP is implemented and maintained by the VP IT and is subject to annual review and approval by the Compliance Committee and Board.

companyName: Cullman Bancorp, Inc. /MD/

ticker: CULL


text: Cybersecurity risks and threats, including as a result of any previous cybersecurity incidents, have not materially impacted and are not reasonably expected to materially impact Coherent or Coherent's operations to date. However, the Company recognizes the ever-evolving cyber risk landscape and cannot provide any assurances that it will not be subject to a material cybersecurity incident in the future.

companyName: COHERENT CORP.

ticker: COHR


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition, although increased use of technology will expose us to greater risk of breaches in security and or service disruptions.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: d. Incorporating external expertise to manage the SOC, perform penetration tests, cyber-attack simulation exercises, and log management to review anomalies indicating a possible breach. e. Maintaining a business continuity program and cyber insurance. f. Performing periodic employee simulated phishing campaigns.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: The Company maintains a cybersecurity program, with direct oversight from senior management and the Board of Directors (the "Board"), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's cybersecurity program has been developed in light of the nature of the Company's business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company's business to broadly implement its cybersecurity program.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Collaborating with third-party cybersecurity consultants, who perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes; Providing regular cybersecurity training for both our employees and Board of Directors.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Our Board of Directors, the Audit Committee and the Cyber Committee, which is chaired by the Chief Executive Officer and staffed by the IT Director, Chief Financial Officer, Corporate Controller and other management employees, are responsible for overseeing cybersecurity risks and risk management. The Board has assigned oversight responsibility for cybersecurity to the Audit Committee, which is in regular communication with management concerning cybersecurity threats and incidents. The Audit Committee reviews management assessment of cyber controls, control testing and outcomes. The Audit Committee is responsible for keeping the Board informed of significant cybersecurity developments including incidents which might potentially have a material effect on the Company. The Cyber Committee is responsible for evaluating cyber threats, the potential effect on operations and scope of the threat. Threats or incidents which the Cyber Committee has judged to have potentially material consequences will be communicated to the Audit Committee. A meeting of the full Board of Directors, including the Audit Committee, will be convened within 48 hours of the Cyber Committee assessment. If the Board determines that the threat or incident is material, Form 8-K will be finalized and filed within four days following the determination, as required under SEC rules. The Company is currently in the process of implementing a more formalized cybersecurity program.

companyName: NeuroMetrix, Inc.


text: We conduct regular reviews and tests of our cybersecurity program, which includes tabletop exercises, penetration and vulnerability testing, simulations, and other exercises, as well as leverage audits by our internal audit team to evaluate the effectiveness of our cybersecurity program and controls and improve our security measures and planning. We also engage external auditors to review our cybersecurity program and controls, as well as engage third parties to perform penetration testing and vulnerability scanning of our public and private assets.

companyName: Gogo Inc.

ticker: GOGO


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, Mr. Chadd Pence. With over 25 years of experience in the field of IT and cybersecurity, Mr.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: To supplement our internal resources, we engage external consultants to conduct independent assessments, perform penetration testing, and provide other cybersecurity-related services as needed. We also utilize external consultants and legal counsel to facilitate cybersecurity tabletop simulations. In addition, we engage external vendors to review and test key controls within our cybersecurity program.

companyName: Ingredion Inc

ticker: INGR


text: We assess cybersecurity risks for their potential impact on our operations, data, and reputation. Risks are prioritized based on their severity and likelihood of occurrence before implementing appropriate controls, safeguards, and mitigation measures to address and manage these risks effectively.

companyName: LITHIA MOTORS INC

ticker: LAD


text: Early on, we identified information security as a salient risk as described in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K. We maintain data privacy and security through a robust program of safeguards, including responsible management, appropriate use, and protection that is designed to address applicable legal and regulatory requirements. Furthermore, all employees are required to complete annual privacy and security training.

companyName: eHealth, Inc.

ticker: EHTH


text: Our Audit Committee directly oversees our cybersecurity program. Quarterly reports are delivered to the Audit Committee by the Chief Information & Digital Officer ("CIDO") and/or the Director of Cybersecurity at least four times per year. These reports include information about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. These reports also include updates on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: Sensata Technologies Holding plc

ticker: ST


text: The Company considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to Air Wisconsin. Certain individuals within Air Wisconsin, including its Chief Financial Officer and Vice President of Information Technology ("IT Management") oversee the design, implementation and enforcement of our cybersecurity risk management program, including a cybersecurity policies and procedures manual. IT Management is supported by Air Wisconsin internal security staff and external experts as part of its continuing education on topics that impact public companies. Air Wisconsin's Vice President of Information Technology has more than 15 years of experience managing and leading IT and cybersecurity teams. IT Management is responsible for efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. In the event of a breach or incident, the cybersecurity policies and procedures manual requires notification to Harbor's board of directors.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: Our board of directors administers its cybersecurity risk oversight function through its audit committee. The audit committee is responsible for overseeing our policies, practices and assessments with respect to cybersecurity, and provides periodic updates to our board of directors. The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures at least semi-annually from our Chief Accounting Officer. Many of our board members have achieved the National Association of Corporate Directors Carnegie Mellon University CERT Certification in Cybersecurity Oversight.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by our group.

companyName: Rocky Mountains Group Ltd


text: Management and Strategy Our processes for assessing, identifying, and managing cybersecurity threats have been integrated into the our overall risk management processes. The information provided by these processes facilitates management's ongoing assessment of our cybersecurity risk environment and provides current and accurate information regarding cybersecurity risks to management, our Audit Committee and Board of Directors to allow appropriate management of such risks through remediation or other risk mitigation activities.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: Although we have internally developed the majority of our line of business applications, we also rely on technology provided by third parties. We have processes in place to oversee and identify risks from cybersecurity threats associated with the use of third-party technology including third-party risk management, process and partner intake risk assessments, and dedicated procurement functions. These processes help mitigate the risks associated with utilizing external technology platforms and help prevent disruptions to our business operations.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Premier address third-party risks as part of Premier's Vendor Risk Management ("VRM") Policy and Program. The purpose of the VRM is to provide a consistent framework to direct Premier in the assessment, measurement, monitoring and control of risks related to vendors and third parties with whom Premier does business. Premier assesses and monitors the cybersecurity controls of third party service providers and partners. As part of the initial and regular monitoring of the vendor, the Company reviews a vendors internal controls based on the COSO framework in alignment with their formal SOC II assessments. The focus of the review is on a vendor's internal management and security practices including but not limited to, physical/systems security, business resiliency, application programing practices, systems security monitoring, and systems change control/authorization.

companyName: PREMIER FINANCIAL CORP


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery. The Cybersecurity Subcommittee held three meetings during the year ended December 31, 2024.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and the Board of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

companyName: Worthington Steel, Inc.

ticker: WS


text: Governance and Strategy Our cybersecurity program is designed to provide logical and physical security protection of our infrastructure, systems and data from theft and destruction that could impact our operations, reputation, and regulatory compliance. To safeguard us from a cyber event, specific mitigating cybersecurity controls, systems and incident procedures exist based upon the United States Department of Commerce National Institute of Standards and Framework ("NIST") Cybersecurity Framework, which is an industry recognized security framework for private and public sectors. Our commitment to cybersecurity is reflected in our extensive program and related technology investments for continual cybersecurity posture enhancements.

companyName: NGL Energy Partners LP

ticker: NGL


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, and muti-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including the senior management and the Board.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: We utilize a Cloud-only architecture which enables us to reduce risk by leveraging the scalability, high availability, and advanced security features of cloud platforms, thereby minimizing the potential for system downtime and data breaches while ensuring seamless disaster recovery options.

companyName: iCoreConnect Inc.


text: Our Board of Directors has ultimate oversight with respect to cybersecurity. At each regularly scheduled board meeting, the Board discusses the steps the Company has taken to ensure proper security. While we have not experienced material cybersecurity incidents in the past, our policies and procedures require us to inform the Board of any material incident.

companyName: HireQuest, Inc.

ticker: HQI


text: Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 17 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Chief Information and Technology Officer has nine years of information technology and cybersecurity experience. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 10 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution. For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see " Part I, "Item 1A. Risk Factors" of this Annual Report on Form10-K.

companyName: S&T BANCORP INC

ticker: STBA