text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our global enterprise IT environment; • a security team responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to security breaches and cyberattacks; • the use of external service providers, where appropriate, to assess, perform tabletop exercises or otherwise assist with aspects of our security controls and designed to anticipate cyberattacks and respond to breaches, including a biennial maturity assessment of our program by an external third-party; • cybersecurity awareness training of our employees and contractors, incident response personnel, and senior management to help them better understand the issues and risks relative to cybersecurity, as well as data privacy (for our employees); • Periodically throughout the year, our IT department performs phishing and other exercises to both test our systems and reinforce training of our personnel; • a cybersecurity incident response plan managed by our CISO that includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of all information possessed by the Company; • policies to establish requirements for protecting information assets and defining acceptable behaviors to ensure compliance, mitigate risks, prevent unauthorized access, and foster a culture of security awareness and accountability, thereby enhancing the organization's overall security posture; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: CHURCH & DWIGHT CO INC /DE/

ticker: CHD


text: Risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our operations and development efforts" in Item 1A-Risk Factors.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA

secItem: Item 1C


text: Our Information Services Department manages our cybersecurity risk management program which is overseen by the Vice President of Information Services. The Vice President of Information Services has a master's degree in business administration with a focus on technology and has decades of professional experience in cybersecurity threat assessments and detection, applicable technologies, incident response and employee training. Our Information Services Department includes a team of experienced professionals who have developed an Incident Response Policy that is regularly reviewed and updated. The Incident Response Policy establishes the required steps to assess, respond to and limit the impact of an incident, details tactical and strategic team membership and points of contact related to the response process and provides for escalating notifications to senior executives, including the Chairman of the Board and Chief Executive Officer, depending on the severity of the threat.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: routine conduct of penetration tests on our computer systems to evaluate the security of the systems and identify weaknesses or vulnerabilities;

companyName: Viewbix Inc.

ticker: VBIX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: Ispire Technology Inc.

ticker: ISPR


text: The Company's management recognizes the critical importance of monitoring for and properly addressing cybersecurity threats. Our Chief Financial Officer is the executive primarily responsible for identifying and managing risks to the Company from cybersecurity threats. With respect to the Company's information systems, we rely on third-party technology and software providers to manage the cybersecurity risk to which those systems are subject. For elements of cybersecurity risk which fall outside the purview of the third-party technololgy and software providers, our Chief Financial Officer oversees the implementation of additional controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company's mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the Company's internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: Cybersecurity threats, including all previous cybersecurity incidents, have not materially affected, or currently are believed by the Company to not materially affect the Company, including its business strategy, results of operations or financial condition. While these risks have yet to materially affect the Company, the Company cannot guarantee that its ongoing and robust approach towards cybersecurity will be able to prevent all cybersecurity incidents that could have a material effect on the Company. For more information about cybersecurity risks that the Company faces, see "If we are unable to protect our information technology infrastructure against service interruptions, data corruption, cyber-based attacks or network security breaches, our operations could be disrupted" in Item 1A, Risk Factors.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: The information security team maintains incident response policies and procedures designed to help protect the integrity, availability and confidentiality of information and help prevent loss of service. Additionally, we conduct an annual cybersecurity awareness training to educate our employees and empower them to help prevent and respond to cybersecurity events and incidents. Cybersecurity events and incidents may be reported or detected through a variety of means, including emails to centralized information security addresses, our online information technology ticketing system, automatic alerts and incident detection systems, direct discovery by our information security team, or reports from employees or other third parties. Additionally, our incident response policies and procedures specify the process for initial investigation and containment procedures, remediation tactics, retention of documentation and internal and external communications. Our incident response policies and procedures also specify processes for analyzing the severity of an identified incident. In response to cybersecurity incidents, we may involve external advisors to assist with remediation efforts and communications and we may seek to mitigate associated liabilities through our insurance coverage. Such third parties may include external legal counsel, forensic investigators and public relation firms, among others. These vendors serve to support our existing processes and procedures and operate as an extension of our enterprise risk management and information security functions.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our Chief Technology Officer leads cybersecurity risk management improvement initiatives as part of our Technology Strategy to 2025, coordinated and monitored by experts from our Technology Leadership Centre. In contrast, the program's implementation at our subsidiaries is largely delegated to the subsidiary staff. Significant subsidiaries provide updates on their implementation progress, significant cybersecurity incidents, and risks to their senior executives and the experts from our Technology Leadership Centre. The experts periodically consolidate and analyze information about the cybersecurity risk management program, cybersecurity and privacy incidents and risks, key initiatives, and other matters relating to cybersecurity processes for reporting to our Chief Technology Officer and our Chief Risk Officer. Both officers periodically report to the Risk Committee of the board of directors. Our Chief Technology Officer also regularly reports directly to the board of directors including on cybersecurity initiatives, notable incidents, and risks. Our Chief Risk Officer also periodically reports directly to the board of directors including on cybersecurity incidents and risks.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors, in conjunction with the New Manager, oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Rithm's CISO and Chief Information Officer ("CIO") on the Company's enterprise risk profile and the Company's risk treatment policies and processes on a quarterly basis or as needed. Additionally, Rithm has protocols by which certain cybersecurity incidents would be escalated in a timely manner to our Audit Committee and Board of Directors.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Our board of directors are responsible for understanding the primary risks to our business. The audit committee of our board of directors is responsible for reviewing our and our Manger's IT security controls with management and evaluating the adequacy of our and our Manager's IT security program, compliance and controls with management. The audit committee receives periodic updates on our cybersecurity programs at the Company, its Manager and its Servicer.


text: Interpublic's senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO and CISO have primary responsibility for managing our cybersecurity program and efforts. They work closely with key stakeholders, including internal committees such as the information security steering committee, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for the testing and audit of our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency. More generally, our Executive Risk Committee has primary responsibility for overseeing the Company's risk framework and the material risks facing our Company.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Cyber Risk Management and Strategy Our Global Security program aims to safeguard critical assets through a risk-based approach to cybersecurity. The CSO provides leadership for the program. We employ a defense-in-depth strategy and has established a Security Risk Management Program. In that regard, we built a customized IRCF that was developed with the specific intent of keeping information assets secure and preventing technology resources from unauthorized disclosure, modification, deletion, and destruction. We have modeled our IRCF on several leading industry standards including portions of the NIST Cybersecurity Framework. The IRCF serves as an organizational model for governance and reporting and is reviewed annually.

companyName: TRINET GROUP, INC.

ticker: TNET


text: The Audit Committee provides oversight of our cybersecurity risk management, as the security of athlete and teammate data continue to be Company-wide priorities. Our cybersecurity risk management is led by our CISO, an accomplished leader in cybersecurity capabilities and management of cybersecurity risk with over 25 years of experience who joined the Company in January 2025. The CISO reports to the Company's Chief Technology Officer, who served as the interim CISO for a portion of fiscal 2024 following the departure of our then current CISO in October 2024, and directly reports to the Company's Chief Executive Officer. The CISO provides quarterly (or more often, if necessary) updates to the Audit Committee and periodic updates to the full Board, regarding existing and new cybersecurity risks, including how management is mitigating those risks. The CISO and the broader cybersecurity team is responsible for detecting, containing, and responding to cybersecurity incidents as documented within the IR Plan.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement the cybersecurity crisis management plan.

companyName: Toppoint Holdings Inc.

ticker: TOPP


text: Incident Response and Assessment Policies and Procedures We align with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we are in the process of implementing a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan will outline communication responsibilities during incidents of all severity levels.

companyName: 374Water Inc.

ticker: SCWO


text: We have established a dedicated team to manage and execute the ISP. A Chief Information Security Officer ("CISO") has been appointed as a Senior Vice President of the Company. The CISO leads the strategy and execution of the program while ensuring clear lines of communication with executive management, committees, the Board of Directors, and external stakeholders such as regulators and insurance carriers. Our present CISO, Scott Bader, was appointed in August 2023 after serving the Company as a senior officer and technology leader for over 15 years and leads a team of Information Security professionals with diverse security backgrounds including relevant certifications (e.g., CISSP, GSEC, GCTI). As a member of our risk organization, the CISO reports to the CRO, who is a member of the Executive Management Committee. Our CRO, Gary Pacos, joined the Company in February 2023 with over 30 years of progressive risk management experience.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Our information security team for UCTS is led by our Chief Technology Officer—UCTS ("CTO"), who also serves as our CISO for UCTS. Our CTO/CISO reports to our President, The Baldwin Group & CEO, Underwriting, Capacity and Technology Operations. Our CTO/CISO has served in the role since 2022 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams across various sectors, including financial services and travel management. Our CTO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CTO/CISO also attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the 12-month period covered by this report, TIAA has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Nuveen Global Cities REIT, Inc.


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Risk Officer and ISO report to the Board and/or Board Risk Committee on cybersecurity risks. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Financial Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.

companyName: SIERRA BANCORP

ticker: BSRR


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date. Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions and our business may be adversely affected by security breaches at third-parties.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: For the fiscal year ended December 31, 2024, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.

companyName: PFIZER INC

ticker: PFE


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security and compliance team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and evaluates material risks from cybersecurity threats and reports to the audit committee of the board of directors ("Audit Committee"), which evaluates our overall enterprise risk.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: We also engage third-party services to conduct evaluations of our security controls, including the IRP, whether through penetration testing, independent cybersecurity audits or consulting on best practices to address new challenges and risks. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: ContextLogic Inc.


text: The IRP contemplates that if a cybersecurity threat or incident is identified, the IRT would communicate the cybersecurity threat or incident and any damages to the CISO and other members of senior management of the Company. The Company then would assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel and assessors would be engaged to evaluate the materiality assessment.

companyName: Solo Brands, Inc.

ticker: SBDS


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Star Holdings

ticker: STHO


text: Data's IT Service Provider monitors cybersecurity events and logs for unusual activity or potential security breaches within the network. E-mail alerts are sent in real time as notification for any suspicious activity including phishing attempts, suspicious attachments, and other e-mail-related security concerns. The IT Service Provider also utilizes security tools to regularly conduct thorough scans of the network infrastructure. The tools help identify vulnerabilities, malware, and other potential threats, enabling a proactive measure to prevent and mitigate cybersecurity incidents.

companyName: Vertical Data Inc.

ticker: VDTA


text: In the event of a material incident, our Board of Directors and our Audit Committee would receive from management prompt and timely information regarding any cybersecurity risk that meet reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: Eiger BioPharmaceuticals, Inc.


text: The audit committee receives periodic reports from management concerning our cybersecurity risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: We employ a "defense in depth" methodology, which focuses on protecting information systems, products and services by deploying multiple layers of security controls in order to mitigate risks. We leverage human capital, customer input, responsive processes, and effective technology as part of our efforts to manage and maintain cybersecurity controls, data access standards, risk management standards, and encryption standards. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cybersecurity risk, including an acceptable-use policy and terms of acceptance that all employees must review and abide by, regular and on-going education and training for employees, information notices, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, network architecture, and data repositories, using internal cybersecurity experts and external specialists and vendors. We require critical third-party vendors to establish incident response and reporting to our information security team and to maintain business continuity plans. We also actively monitor our e-mail gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. Remote workers are required to login to our network through a secure virtual private network with password and multi-factor authentication in order to minimize security risks while working outside the office. The Information Security Department consistently identifies vulnerabilities with our systems, implements protective updates and patches, and monitors the status of remediation efforts. Regular reports on these activities are provided to management committees to ensure transparency and oversight of our cybersecurity practices.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: The Company's Chief Information Security Officer, in coordination with the Information Security Leadership Group, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response plan. Through ongoing communications with these teams, the Chief Information Security Officer and the Information Security Leadership Group monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Board when appropriate, as addressed above.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Ellington's cybersecurity processes and practices are integrated into Ellington's risk management and oversight program. In general, Ellington seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Ellington collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.

companyName: Ellington Financial Inc.

ticker: EFC


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, penetration testing providers, cybersecurity consultants, forensic investigators, training platforms and managed cybersecurity service providers.

companyName: Vital Farms, Inc.

ticker: VITL


text: All of the software that we use is Commercial Off the Shelf Software (COTS) and Microsoft, Dropbox, and Google cloud services. We do not develop, modify, or customize any software for our own use. We rely on the cybersecurity measures and practices of our software and cloud service providers and update our software and systems regularly to address any known vulnerabilities or issues. We also limit the access and use of our software and cloud services to authorized personnel and encourage them to use strong passwords and multifactor authentication. We do not store any sensitive or confidential data on our own devices or media, but use password-protected cloud storage.

companyName: Mitesco, Inc.

ticker: MITI


text: When engaging third-parties, we have procedures and protocols designed to protect our information technology systems and our confidential information. For example, before we grant third-parties access to our information technology systems, we require typically agreements with such third-parties, we ordinarily require such third parties to complete cybersecurity training and we typically require specific contract terms in our agreements with such third-parties.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our CISO leads an Information Security team that meets regularly. The CISO updates the executive management team on cybersecurity developments.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Director. Our IT Director has over 10 years of experience addressing cybersecurity risks. Our IT Director is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Chief Technology Officer oversees the IT Director and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Management & Strategy MetLife manages information security risk through, and as part of, MetLife's Information Security Program (the "Program"), which institutes and maintains controls for the systems, applications, and databases of MetLife and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology, and is managed by MetLife's CISO, in collaboration across lines of business and corporate functions. The Board of Directors of MetLife, Inc. (the "Board" or "Board of Directors") oversees the Program.

companyName: METROPOLITAN LIFE INSURANCE CO


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we fail to implement effective information security policies and procedures."

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Role of Management Our cybersecurity risk is managed utilizing a multi-tiered approach by our Director of Information Technology. In addition to the Director of Information Technology, we also engage the services of a third-party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Cybersecurity is an important part of our overall risk management systems and processes and an area of focus for our Board and management. We have developed and implemented an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity and privacy threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools; an internal continuous pen testing program; and a third-party pen testing program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate, and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. Emerald's third-party security program is designed to mitigate cybersecurity risks associated with external service providers. This program includes conducting rigorous security assessments of potential third-party partners before onboarding, ensuring they meet our high standards for cybersecurity.

companyName: Emerald Holding, Inc.

ticker: EEX


text: Recovery—bring affected production systems back online carefully, to prevent additional attacks. Test, verify and monitor affected systems to ensure they are back to normal activity.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: As discussed above, our CIO and CISO also provide regular reports regarding risks from cybersecurity threats to our Audit Committee and, depending on the materiality of a risk, the full Board. In addition, from time to time, members of management may provide reports to a special committee of the Board for cybersecurity. For example, as discussed above, management provided regular reports to the Special Committee on various aspects of the ransomware incident we identified in February 2023.

companyName: MKS INC

ticker: MKSI


text: Oversight and Governance The Board of Directors is responsible for overseeing risks related to cybersecurity and has delegated to the Audit Committee oversight over cybersecurity risks. The Audit Committee is responsible for reviewing and discussing with management the processes to identify, assess and manage cybersecurity threats, as well as to identify, assess and, to the extent required, disclose material cybersecurity threats.


text: Reporting to our Board of Directors Given the importance of information security and privacy to our stakeholders, our Board of Directors receives an annual presentation from our senior management team discussing our program for managing information security risks, including cyber and data security risks. Our senior management team receives regular reports on our cybersecurity readiness, our risk profile status, our cybersecurity program, material cybersecurity risks and mitigation strategies, third-party assessments of our cybersecurity program and other cybersecurity developments. Our senior management team reports to the Board of Directors and the Audit Committee on such topics, as needed, and at regularly scheduled meetings of the Board of Directors and Audit Committee as part of the business, legal and regulatory update portions of such meetings.

companyName: Greenbacker Renewable Energy Co LLC


text: Management plays a critical role in assessing and managing the company's material risks from cybersecurity threats. Cybersecurity efforts are overseen by the Chief Digital Officer, supported by a dedicated team. The Chief Digital Officer has over 20 years of experience in leadership roles in the digital domain at renowned organizations such as Nasdaq and TIAA. Their expertise encompasses a deep understanding of cyber threats, risk management strategies, and regulatory compliance requirements which positions the Chief Digital Officer to lead the company against evolving cyber-related threats.

companyName: Altus Power, Inc.


text: We also engage with various external experts, including cybersecurity assessors and consultants, to conduct cybersecurity program and threat assessments and to advise management on ways to enhance our cybersecurity program as part of our continuing efforts to evaluate the effectiveness of our information security program. We utilize certain third-party service providers to perform a variety of functions to operate our business and we seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity of the information, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, and conducting security assessments.

companyName: RXO, Inc.

ticker: RXO


text: Conducting subsequent penetration testing and vulnerability assessments, as warranted; and Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: These risk assessments inform TPG's cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the TPG team's response readiness capabilities.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Our cybersecurity risk management program ("cybersecurity program") is designed and assessed by leveraging the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), customized to align with our entity size, risk profile, and industry best practices. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: BTCS Inc.

ticker: BTCS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Lead. Our IT Lead has 11 years of experience in roles that include oversight of cybersecurity risk management programs. In addition, the IT Lead is assisted by an external agency with about 8 years of expertise in cybersecurity.

companyName: IGC Pharma, Inc.

ticker: IGC


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of the data we use in our business, as well as our employee and research data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact.

companyName: YIELD10 BIOSCIENCE, INC.


text: Our board of directors, through its audit committee, oversees our processes for identifying and mitigating risks, including cybersecurity risks. Management will periodically brief the audit committee and/or the board of directors on our cybersecurity and information security policies and plans. Our board of directors will be apprised of cybersecurity incidents deemed to have a moderate or higher business impact, and we will provide updates on management's incident response plan for addressing and mitigating any impacts and risks associated with such an incident. We intend to develop a formal incident response plan, which sets forth the steps to be followed from incident detection and assessment to mitigation, recovery and notification and reporting within our organization and to our board of directors.

companyName: Modular Medical, Inc.

ticker: MODD


text: The Company has a Cybersecurity Plan for assessing, identifying, and managing material risks from cybersecurity threats. The intent of the Cybersecurity Plan is to provide a proactive and systemic approach to meet the evolving requirements for cybersecurity and related compliance in the utility industry. The Cybersecurity Plan's objectives include: adopting and using established cybersecurity standards and industry best practices; protecting personally identifiable information; protecting infrastructure operations, including Supervisory Control and Data Acquisition (SCADA) systems at electric substations and natural gas plants; securing customers', employees', and the Company's data;

companyName: UNITIL CORP

ticker: UTL


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: Liberty Media Corp

ticker: FWONA


text: Valkyrie will maintain reasonably up-to-date firewall protection (if applicable) and operating system security patches, reasonably designed to maintain the integrity of the personal information, installed on systems processing personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: As an exploration stage company, we have limited operations and our business activity to date has been identifying, acquiring, and exploring mineral properties. We have not yet adopted formal cybersecurity risk management programs or formal processes for assessing cybersecurity risks. We understand the importance of managing material risks from cybersecurity threats and are committed, as part of our continuing growth, to implementing and maintaining an adequate information security program to manage such risks and safeguard our systems and data. Data used and stored on our information systems currently is limited to basic information related to our core business operations, which at this time are not materially dependent on information technology. Also, we do not store in our systems any customer or similar data.

companyName: Atlas Lithium Corp

ticker: ATLX


text: The Incident Response Plan has been developed to align with the four phases for the security handling lifecycle set forth in the National Institute for Standards and Technology Special Publication 800-61: (1) Preparation, (2) Detection & Analysis, (3) Containment Eradication & Recovery, and (4) Post-Incident Activity.

companyName: CARTERS INC

ticker: CRI


text: Our cybersecurity risk management program includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization in order to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment. The information technology and legal departments help identify, assess and manage Sangamo's cybersecurity threats and risks. The information technology department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and Sangamo's risk profile using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer and Chief Financial Officer are the members of management responsible for managing and assessing our cybersecurity practices. Our Chief Executive Officer and Chief Financial Officer have each served as executive officers of public companies in the past. The plan for the future is that they will report to the Audit Committee on cybersecurity on a semi-annual basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: In the regular course of our business, the Company manages a range of sensitive security, customer, and business systems information. A security breach of our information systems such as theft or the inappropriate release of certain types of information, including confidential customer, employee, financial or system operating information, could have a material adverse impact on our financial condition, results of operations or cash flows. The Company operates in a highly regulated industry that requires the continued operation of sophisticated information technology systems and network infrastructure. Despite implementation of security measures, the technology systems are vulnerable to disability, failures or unauthorized access. Facilities, information technology systems and other infrastructure facilities and systems and physical assets could be targets of such unauthorized access. Failures or breaches of our systems could impact the reliability of systems and also subject the Company to financial harm. If the technology systems were to fail or be breached and if the Company is unable to recover in a timely way, fulfilling critical business functions and sensitive confidential data could be compromised, which could have a material adverse impact on the Company's financial condition, results of operations or cash flows.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: We have a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our data and systems. We are also subject to mandatory cybersecurity regulatory requirements. Our risk management programs, which address both enterprise and energy commodity risks, provides for evaluating and addressing cybersecurity risks and cybersecurity compliance. As part of our evaluation of cybersecurity risks, we consider cybersecurity risks and threats related to use of third-party service providers. Depending on the third-party service provider, the services provided by such third party and the data stored or to which such third party has access, we require different cybersecurity protections and specific cybersecurity programs that the third party must maintain. Our Utility Members have their own independent cybersecurity programs and procedures.

companyName: Tri-State Generation & Transmission Association, Inc.


text: Engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security program.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: Cybersecurity risk management is incorporated into our overall enterprise risk management program. As part of its enterprise risk management efforts, critical enterprise risks are assessed by senior management annually and discussed with the Company's Board of Directors.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: Blackstone's CTO is a Senior Managing Director and the head of BXTI. Our CTO has over 23 years of information security, technology and engineering experience, including having previously served as the Chief Technology and Chief Innovation Officer at a large financial institution. Our CTO is responsible for all aspects of technology across Blackstone, advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and externally managed companies, such as us, on technology-related matters.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Data Protection Culture Chubb actively promotes a data protection culture. We maintain policies and standards designed to protect personal and corporate information. The policies and standards are developed by a multi-disciplinary team, with participation from information security and IT compliance, privacy, IT legal, compliance, and business representatives.

companyName: Chubb Ltd

ticker: CB


text: Our Adviser and Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT") and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assists our Adviser and Administrator in monitoring our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT and Chief Compliance Officer ("CCO"), which then are considered by other relevant officers of our Adviser and Administrator before implementation.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: Cybersecurity risk management is an important part of MasTec's overall risk management efforts. We maintain a comprehensive enterprise-wide information security program that comprises policies and controls designed to identify, safeguard against, detect, respond to, mitigate and manage reasonably foreseeable cybersecurity risks and threats. Our approach utilizes diverse security tools to prevent, identify, investigate, resolve and recover from vulnerabilities and security incidents. These include, but are not limited to, internal reporting, monitoring and detection tools.

companyName: MASTEC INC

ticker: MTZ


text: The Company utilizes information systems to support a variety of business processes and activities in its operations. These systems may be subject to cyber-based attacks or breaches. Some examples of the cybersecurity threats that could negatively impact the Company are denial of service attacks, excessive port scans, firewall breach and computer virus outbreak.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: The Company's Information Security Officer (ISO), James Hinks, leads our cybersecurity program and oversees the Company's Security Operations Team (SOC), supporting our security functions of identifying, preventing, detecting, responding, and recovering. The SOC team comprises personnel with extensive experience in information technology across the private and public sectors. Mr. Hinks holds multiple security accreditations and 24 years of experience in cybersecurity, software development, systems, networking, and other technology-related roles within public and private industries, with 14 years in IT leadership roles. Mr. Hinks has been employed with the Company since 2019, overseeing information security, disaster recovery, vendor management, and physical security.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: Our employees and vendor partners are also trained to report any security events to the cybersecurity team, who will escalate and notify the legal team, senior executives, and Board of Directors as needed.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Material Cyber Risks, Threats and Incidents We actively monitor the evolving cybersecurity and geopolitical landscapes that could result in new or increased cybersecurity threat including geopolitical events such as the war in Ukraine.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Each Trimble business has identified a dedicated expert to assess vulnerabilities, calculate risks, and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security, and mobile device usage. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We also conduct regular phishing simulations, with follow-up training as needed, for employees and contractors. We maintain an information security risk insurance policy.

companyName: TRIMBLE INC.

ticker: TRMB


text: Reporting directly to our CIO, our Cybersecurity Manager brings over 15 years of experience in aerospace IT organizations, coupled with more than 10 years of expertise in cybersecurity.

companyName: Rocket Lab Corp

ticker: RKLB


text: Senior management and personnel of our Sponsor and our Advisor, which includes our Advisor's personnel, work to conceive, implement, and monitor the effectiveness of a program designed to protect our information systems from cybersecurity threats and to promptly respond to any security incidents.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K. Governance Disclosure.

companyName: IMMERSION CORP

ticker: IMMR


text: Our cybersecurity management processes are implemented and maintained by our Information Security Team, in consultation with members of our cybersecurity incident management team. Our cybersecurity incident management team is led by our Vice President, Cybersecurity and includes our Chief Human Resources Officer, Vice President, Privacy, senior personnel from our legal, finance, and relevant business departments (the Incident Management Team). Our Vice President, Cybersecurity brings extensive experience in software development, IT, and cyber security, gained in over two decades in the telecommunications, financial services, defense, and healthcare sectors. Notably, he spent four years at a medical device company focused on insulin delivery, where he successfully established the product security program and played a pivotal role in obtaining clearance for its flagship product line.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: The Company (or third parties on which it relies) may not be able to fully, continuously and effectively implement security controls as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security controls to implement, and it is possible that the Company may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties it relies upon).

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Although we believe we and our IT providers employ appropriate security technologies (including data encryption processes, intrusion detection systems), and conduct comprehensive risk assessments and other internal control procedures to assure the security of our and our customers' data, we can provide only reasonable, not absolute, assurance that these objectives will be met. Further, the design of any cybersecurity risk management program or control system must reflect the fact that there are resource constraints, and the benefits must be considered relative to their costs. As a result, the possibility of material financial loss remains despite our significant and comprehensive cybersecurity efforts. An investor should carefully consider the risks and all other information set forth in this Annual Report on Form 10-K, including disclosures in Part I - Item 1A—Risk Factors.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: Our Chief Information Security Officer, who reports to our Chief Risk Officer, is responsible for managing our information security team, maintaining, and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats, subject to oversight by and reporting to the Board Risk Committee, which in turn reports directly to the Board. In addition to the Board Risk Committee, two of our management committees are also involved in overseeing risks from cybersecurity threats: our Enterprise Risk Management Committee and our Information Security Sub-Committee. These two management committees report to the Board Risk Committee, which in turn reports directly to the Board.

companyName: HOPE BANCORP INC

ticker: HOPE


text: We have implemented and actively maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, and strategic or competitive in nature ("Information Systems and Data").

companyName: LUMOS PHARMA, INC.


text: The Company evaluates new and existing third-party service providers and suppliers through a risk assessment that includes interviews and questionnaires to assess their cybersecurity capabilities, process maturity, compliance attestations and the overall technology relationship risk. Each third-party risk assessment is conducted during the contract negotiation process, during certain contract milestones and at other periodic intervals. The final risk assessments and reports are shared with internal teams and IT leadership to assist with ongoing risk mitigation actions. The Company's cybersecurity defense strategy is regularly tested through internal and third-party penetration testing. Additionally, the Company's cybersecurity program maturity and risk profile is regularly analyzed and measured internally against generally accepted industry standards and frameworks, including the NIST Cyber Security Framework, the FAIR model and external third-party maturity assessments.

companyName: MASONITE INTERNATIONAL CORP


text: We have executed on this strategy with a cloud-first approach, awareness training, and deliberate use of well-established vendors for software and hardware solutions.

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: For additional information regarding how cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors—":

companyName: ADT Inc.

ticker: ADT


text: Our CISO has significant information technology experience, having served in various roles in information technology and information security for more than 20 years, including serving in various cybersecurity leadership roles within public and private companies. He holds an undergraduate degree in management and obtained CISO Executive Education Certification from Carnegie Mellon University. Cybersecurity leaders reporting to our CISO also have significant relevant experience and industry recognized certifications.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: We engage external parties, including consultants, computer security firms, forensic firms, public relations professionals and attorneys, to advise us on our preparedness and risk management activities. We also regularly consult with industry groups and law enforcement on emerging industry trends.

companyName: LL Flooring Holdings, Inc.


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, and Vice President, Human Resources & IT, who help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: SCYNEXIS INC

ticker: SCYX


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit and Finance Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit and Finance Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.

companyName: INCYTE CORP

ticker: INCY


text: Our Chief Financial Officer and Corporate Controller oversees our cybersecurity program and is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. These officers work with other members of management, employees and outside service providers to promote and evolve our cybersecurity protocols and systems. There were no material cybersecurity incidents in 2024 or up to the date of this filing.

companyName: Salamander Innisbrook, LLC


text: DFIN manages and continues to mature a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The processes also include evaluating existing suppliers and third parties for ongoing risk. The classification rating determines the frequency in which suppliers are evaluated. For example, those identified as critical suppliers are continuously monitored and assessed. Other supplier reviews occur on an annual basis or other cadence. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that were determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: We maintain a written incident response plan and carry out periodic tabletop exercises to improve incident response readiness. Employees undergo security awareness training when hired and periodically thereafter; the scope of this training is continually updated to address newly identified threats. We utilize a risk-based approach and analysis to determine the cybersecurity controls to implement, and hence, there is a possibility that these controls may not adequately address every risk if we do not identify or place a high enough risk factor on a given threat. We are at risk of zero-day attacks and other vulnerabilities that may have been placed at a very low risk. In addition, even well-designed and properly deployed controls may not fully eliminate a given risk.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: Our Chief Compliance Officer has 40+ years of experience leading global legal and compliance departments. He holds an undergraduate degree in economics from the Wharton School of Business and a Juris Doctor from Columbia University School of Law.

companyName: NCR Atleos Corp

ticker: NATL


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: The Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). Our quarterly updates to the Audit Committee include a discussion of our information security programs and controls, including our internal auditor's review and our internal monitoring of cybersecurity risks. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Team) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: Our third-party vendor, alongside our senior management leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. As a smaller-reporting Company we do not have an employee who has significant and demonstrated professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. The audit committee of the board of directors intends to provide oversight of our cybersecurity risk as part of its periodic review of enterprise risk management.

companyName: Envoy Medical, Inc.

ticker: COCH


text: Table of Content s Management's Role in Assessing and Managing Cybersecurity Risks The CIO, in collaboration with our CISO, and other key leaders across HF Sinclair operations, are primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to our executive team.

companyName: HF Sinclair Corp

ticker: DINO


text: Our Board is responsible for overseeing our strategy and approach to addressing information security risks, including managing and assessing risks from cybersecurity threats, both directly and through the audit committee. The audit committee is responsible for reviewing and monitoring the Company's cybersecurity and information security policies and its internal controls regarding cybersecurity and information security. In addition, the audit committee is responsible for regularly reporting to the Board on the substance of such reviews and, as necessary, recommending to the Board such actions as it deems appropriate. Our CISO reports on information security risks at least quarterly to the audit committee and at least annually to the Board.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO and CTO as appropriate.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: The Company integrates cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. The head of our IT department continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST").

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: We recognize the importance of cybersecurity in our operations. We face diverse cybersecurity threats, ranging from unauthorized individual access attempts to sophisticated disruptions targeting our business and customer data. Our operations involve collecting and storing customer information in cloud systems, such as Google Drive, and we rely on third-party providers, such as Google, whose systems may encounter interruptions and/or cybersecurity incidents.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: Jack Henry's information and cybersecurity program is a key component of our overall enterprise risk management and is maintained by a team of diverse, highly skilled cybersecurity professionals, as well as a portfolio of investments in modern technology, including artificial intelligence and machine learning. The program safeguards Jack Henry and client confidentiality and privacy by systematically identifying, assessing, and managing material risks and cybersecurity threats through use of comprehensive cyber defense, threat and vulnerability management, and cyber intelligence. Our cybersecurity program includes continuous enterprise monitoring with well-defined and rehearsed business resilience and incident response procedures. Further, we use third-party vendors and consultants to assist in identifying and assessing cybersecurity risks.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Our program also utilizes third-party security providers for specialized areas, including penetration testing, staff augmentation, consulting and other on-demand cybersecurity services. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities.

companyName: HOLOGIC INC

ticker: HOLX


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risk. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Our disclosure controls and procedures provide for the CSIHT to report high severity cybersecurity incidents to an Assessment Committee, consisting of our CFO, CISO and General Counsel, among others, for an assessment of materiality. The Assessment Committee in consultation with third-party experts, as warranted, makes the incident materiality determination consistent with SEC guidance.

companyName: Lazard, Inc.

ticker: LAZ


text: Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information technology systems or data or those of our partners or contractors are compromised, our business could experience adverse consequences, including regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; and loss of revenue, income, or profits" and "Compliance with the stringent and changing obligations related to data privacy and security is an onerous and resource-intensive process. Our actual or perceived failure to comply with any data privacy or security obligations could lead to regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations; reputational harm; loss of revenue, income, or profits; loss of customers or sales; and other adverse business consequences."

companyName: XOMA Royalty Corp

ticker: XOMA


text: All computers and servers utilized by the Company are protected by endpoint protection, which provides real-time protection of local and network files, internet activity, and utilizes ransomware protection, application protection, malicious behavior protection, anti-malware scan interface protection, file integrity monitoring, and data loss prevention. Our endpoint protection software updates immediately upon definition releases. This endpoint has live protection and performs a deep system scan daily. Our endpoint protection products are managed by our IT Security Team via a dashboard that provides our team with immediate alerts, device isolation, and investigation features, and also contracted the use of a Managed Detection and Response ("MDR") service. The MDR service monitors our protected endpoints, servers, and network equipment at all times. This service also investigates, eliminates, and mitigates any critical alerts, while notifying our IT Security Team issues identified. All endpoints and servers are updated with security patches and application updates to our systems from a Patch Management system.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: The Board of Directors, acting directly and through its committees, is responsible for the oversight of our risk management programs. The Board's Risk & Sustainability Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats. The committee also provides oversight of our policies and processes for monitoring and mitigating such risks. Among other duties, the Risk & Sustainability Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate. The committee meets at least quarterly, and the chair of the committee gives regular reports to the Audit Committee and the full Board of Directors on its activities.

companyName: CLARIVATE PLC

ticker: CLVT


text: Our cybersecurity organization collaborates heavily with technology, business and legal stakeholders to enable secure business strategy, maintain, and grow proper security oversight, enhance security monitoring and response, and quantify and reduce risks and compliance gaps. There are six key focus areas within the cybersecurity organization: enterprise security operations, architecture and security engineering, identity access management, IT risk management and compliance, governance, risk and compliance, and strategy and program delivery. Additionally, we aim to incorporate a broad range of industry-standard cybersecurity best practices throughout our cybersecurity organization. These include, among other things: • an insider threat program that coordinates resources to discourage, identify, and mitigate cybersecurity threats; • regular audits of HP cybersecurity systems and annual risk assessments of related HP systems and processes, including our information security management systems; • an incident response plan that sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate; • annual and ongoing security awareness training for employees; • a cybersecurity/information security policy, as well as an acceptable use policy that defines the permitted usage of company-provided technology and contains consequences for noncompliance; • company-wide privacy policies as well as a physical security program that secures our offices and data center facilities; • systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use; and • engagement with industry peers and participation in cybersecurity forums to share knowledge and learn from best practices.

companyName: HP INC

ticker: HPQ


text: Company engages a third-party provider to maintain our systems and management participates in the assessment to identify any risks from cybersecurity threats. Our third-party provider monitors our firewall, network, system security and internal and external backups and reports any issues to the Company. The Company's Board, together with management, is engaged in our cybersecurity monitoring managed by our third-party provider and it is constantly changing. Any issues are appropriately addressed timely. To date, we have no t experienced any cybersecurity incidents that materially affected our business strategy, results of operations or financial condition.

companyName: Brownie's Marine Group, Inc

ticker: BWMG


text: We rely on our IT systems to effectively manage and operate our business, including such processes as data collection, accounting, financial reporting, communications, supply chain, order entry and fulfillment, other business processes, and in operating our equipment. A cybersecurity incident could disrupt our business and could result in transaction errors, processing inefficiencies, limited equipment utilization, the loss of sales, customers, or intellectual property, causing our business and financial results to suffer. Although such risks have not materially affected our business, financial conditions, results of operations or reputation to date, we have, from time-to-time experienced cybersecurity incidents in the normal course of business. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors".

companyName: CONSTELLIUM SE

ticker: CSTM


text: The Company's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of the Company's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. The Company regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to the Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.

companyName: BlackRock Finance, Inc.


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: We use many third parties for IT functions and our vendor management group performs information security risk assessments on our third-party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third-party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third-party service providers.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Our cybersecurity function, which comprises, in part, our information technology ("IT") security director and other members of our technical staff management, along with our legal advisors, risk management team, and overall information security function, helps identify, assess and manage our cybersecurity threats and risks. Our IT security department, under the direction of our Chief Information Officer ("CIO") and led by our IT security director, identifies and assesses risks from cybersecurity threats by monitoring cybersecurity and operational risks using various security tools designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our information security management system to support and promote resilient programs. This includes automated tools, security assessment and monitoring; restricted physical access to servers and network equipment, system audits and third party assessments, third-party IT vendor risk management process to assess and manage risk presented by our IT vendors, third party threat assessments, evaluating threats reported to us, and annual review of cybersecurity insurance policies and the associated levels of coverage based on current risks.

companyName: biote Corp.

ticker: BTMD


text: Our Enterprise Information Security Policy contains existing controls to protect information systems (and the data hosted within) and to educate personnel as to the proper use, disclosure, modification, or destruction of that data. The Policy is further intended to reasonably protect our systems and data against internal and external threats that could impact it. We periodically review this Policy for improvements and request each account user to read and attest to the Policy annually. We employ a Defense-in-Depth approach to information security, which includes adoption of network perimeter, endpoint, and end-user controls in accordance with the Policy. We are focused on improvement of our security posture; we are periodically assessed by internal and external audits, as well as third-party security experts, such that our program continues to address and respond to evolving threats.

companyName: Evercore Inc.

ticker: EVR


text: Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the business to manage our security controls, and translate our external requirements into policies, standards, and actions for the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.

companyName: Criteo S.A.

ticker: CRTO


text: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information.

companyName: Sitio Royalties Corp.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation.

companyName: Xencor Inc

ticker: XNCR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our corporate operations, business strategy, results of operations, or financial condition. See "Part I-Item 1A. Risk Factors - Technology and Information Systems Risks." As noted above, given our status as a REIT, we do not have actual or contractual access to the systems or information maintained by the property operators, managers and franchisors and we must rely on such operators', managers' and franchisors' programs and processes to protect the properties in which we invest.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: The Audit Committee of our board of directors provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, our management provides updates to the Audit Committee regarding our internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Our management also reports any material risks from cybersecurity threats to the Audit Committee. Our management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.

companyName: LiveOne, Inc.

ticker: LVO


text: Role of our Management Our management has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by our Board of Directors of the processes we establish to assess, monitor and mitigate that exposure.

companyName: Ventas, Inc.

ticker: VTR


text: The Company's CIO is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. The Company's CIO has over 20 years of experience in the field of technology and security including experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes its CIO's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: We have an enterprise-wide approach to addressing cybersecurity risk, including input and participation from management and support from our Information Technology ("IT") Steering Committee that is comprised of our Senior Vice President Electronic and Structural Systems, Chief Financial Officer, General Counsel, Chief Human Resources Officer, Vice President Supply Chain Management, and Chief Information Security Officer (Head of IT and Cybersecurity or "CISO"). Our cybersecurity risk management program leverages the National Institute of Standards and Technology ("NIST") Framework which is augmented with Cybersecurity Maturity Model Certification ("CMMC") components to meet our particular needs. We regularly assess the threat landscape and take a holistic view of the cybersecurity risks, with a layered cybersecurity strategy based on protection, detection, and mitigation. Our IT security team, which is comprised of internal resources, reviews enterprise risk management-level cybersecurity risks at least annually.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Adial acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: ADIAL PHARMACEUTICALS, INC.

ticker: ADIL


text: Our management team, including our Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Officer has many years of experience leading cybersecurity oversight and overall has broad, extensive experience with information technology, including security, auditing, compliance, systems and programming.

companyName: VORNADO REALTY LP


text: In 2024, we did not identify any cybersecurity threats that would have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our information technology ("IT") personnel, together with third party firms, continuously work to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, [including the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443]. Our executive management team and Board of Directors are periodically updated regarding the status of, and adjustments to, our cybersecurity program.

companyName: Smart Sand, Inc.

ticker: SND


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated certain Company employees as members of a cybersecurity incident response team, including the Chief Accounting Officer, the Chief Financial Officer, and the IT Manager. This team helps the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: NETSTREIT Corp.

ticker: NTST


text: We rely on the representations and certifications of key partnerships with suppliers recognizing these third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for technology supplier selection.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Our cybersecurity governance framework includes documented policies, procedures, and controls designed to mitigate cybersecurity risk. We also perform regular risk assessments of our infrastructure, network architecture, and software/systems using current threat intelligence received from a variety of sources. We employ various preventative and detective controls to block, monitor, and alert for suspicious activity. Additionally, we engage third-party experts to perform periodic internal and external assessments, including penetration testing and vulnerability scanning. We also maintain an ongoing education and training program designed to increase employee awareness and gauge risks relative to the human element. Moreover, we maintain a third-party risk management program designed to identify, assess, and mitigate risks, inclusive of cybersecurity risk, associated with third-party service providers and Hanover's supply chain vendors. Lastly, we engage third-party audit firms to periodically assess our IT general controls and information security.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on our risk management process and the risk trends related to cybersecurity at least annually. The CTO attends all quarterly Board meetings and presents to the Board at a minimum of twice per year on security and cybersecurity KPIs and threat mitigations. The Audit Committee oversees risks including cybersecurity risks. Our internal audit team reports on cybersecurity risks and internal and external audit results to the Audit Committee. Internal Audit performs IT security and compliance audits for SOX 404 purposes, as well as testing Euronet's security standards, and performs pre-assessments for ISO 27001. We also engage third party independent assessments for penetration testing, vulnerability assessments, and certification such as PCI DSS, ISO 27001, VISA PIN and SOC Type 1 and Type 2 audits. The CTO and CISO also have weekly and monthly meetings with senior executive management to discuss security strategy, projects, and concerns. We have an established incident response process led by our CISO governing our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our Chief Executive Officer, executive management team, and the Board as well as regulatory notifications depending on the jurisdiction and specifications of the incident.

companyName: EURONET WORLDWIDE, INC.

ticker: EEFT


text: Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, derived from industry standards and best practices.

companyName: Investview, Inc.

ticker: INVU


text: The CISO chairs the Company's Cybersecurity Oversight Council, a cross-functional management committee that drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management. The Cybersecurity Oversight Council is sponsored by the Company's Global General Counsel and CIO and is composed of senior leaders from our privacy, legal, information technology, cybersecurity, internal audit and global security and asset protection functions, among others. Subject matter experts are also invited, as appropriate. The Cybersecurity Oversight Council meets at least quarterly and has responsibility for oversight and validation of the Company's cybersecurity strategic direction, risks and threats, priorities, resource allocation, capabilities and planning. The Cybersecurity Oversight Council acts in alignment with the Company's Risk Steering Committee, another cross-functional management committee, which provides strategic direction and oversight over the Company's ERM program. The CISO and his team, as well as the Cybersecurity Oversight Council, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the Company's cyber incident response plan.

companyName: COCA COLA CO

ticker: KO


text: For additional information related to the cybersecurity-related risks relevant to our business, see "Risk Factors—Technology and Data Security Risks—Security breaches and other disruptions to our information technology infrastructure could compromise Company, consumer and customer information, interfere with our operations, cause us to incur significant costs for remediation and enhancement of our IT systems and expose us to legal liability, all of which could have a substantial negative impact on our business and reputation" in Part I, Item 1A. of this annual report on Form 10-K.

companyName: EQUIFAX INC

ticker: EFX