text: The Board of Directors, as a whole, has oversight for the most significant risks facing us and for our processes to help identify, prioritize, assess, manage, and mitigate those risks. The Board receives at least quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Business Operations as well as other members of the senior leadership team.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii) protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our board of directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Administrative Officer, or CAO, and Vice President of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our CAO reports directly to our Chief Executive Officer and our Vice President of Information Technology reports directly to our CAO.

companyName: Pacira BioSciences, Inc.

ticker: PCRX

secItem: Item 1C


text: The Board of Directors is composed of members with diverse expertise including, risk management, technology, and finance domain expertise, equipping them to oversee cybersecurity risks effectively.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: TVA's cybersecurity risk management programs and processes exist under a written cybersecurity policy, which provides the foundation for TVA's information security programs. Under the policy, TVA engages assessors, consultants, auditors, and other third parties. All TVA employees, contractors, grantees, other federal agencies, state and local governments, industry partners, and others who possess TVA information or who operate, use, or have access to TVA's information systems are made responsible for complying with TVA's cybersecurity policy and information security-related communications, plans, practices, procedures, and standards issued as part of the information security programs.

companyName: Tennessee Valley Authority

ticker: TVE


text: Role of Management Through our services agreement with Liberty Media, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level. The ISSC receives regular reports and updates from Tripadvisor regarding their cybersecurity risk management activities and, if any, incidents that have occurred.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Our cyber defense practices prioritize protection against cyber threats. We have operationalized tools and processes designed to educate, assess, identify, address, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems. We routinely perform cybersecurity assessments, including with the assistance of external third parties, to identify, assess, and prioritize potential risks that could affect our information and data assets and infrastructure. Once identified, the mitigation of these risks is given our highest priority.

companyName: Research Solutions, Inc.

ticker: RSSS


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan and is integrated with our overall enterprise risk management program, sharing common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. While we may not meet any particular standard, specification or requirement of the Center for Internet Security Critical Security Controls, we utilize such controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. Additionally, we are required by certain customers to maintain controls and processes pursuant to applicable cybersecurity regulations and frameworks.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: The cybersecurity function performs an annual threat and risk assessment that drives our security strategy. The strategy is aligned to the ISO 27001/02 and NIST cybersecurity frameworks, which drive our security policies and procedures. These policies and procedures, along with enabling security technology and qualified security function employees, maintain activities to prevent, detect, and minimize the effects of cybersecurity incidents. Cybersecurity technology and practices are in place to enable the protection of consumer and employee personal data and confidential information.

companyName: FIVE BELOW, INC

ticker: FIVE


text: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards. While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, reputation, results of operations and financial condition. During the reporting period, the Company had not experienced any material cybersecurity events or incidents. Although third party service providers that the Bank engages have encountered cybersecurity events or incidents during the year ended December 31, 2024, the Bank's investigation of each event or incident has shown that these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: The Company's information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information. Our Chief Information Security Officer, who reports to our Chief Risk Officer, manages our information security strategy and development within our overarching Enterprise Risk Management program.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.

companyName: Beauty Health Co

ticker: SKIN


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who, from June 2018 to March 2024, was Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.

companyName: Anywhere Real Estate Group LLC


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include, but are not limited to, risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: The Enterprise Risk Management Committee of the Board has primary responsibility for overseeing the Company's comprehensive ERM program. The ERM program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our CTO is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our current CTO has over 30 years of experience in information technology and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CTO provides periodic updates on our cybersecurity risk profile to management and the audit committee of our board of directors.

companyName: Semler Scientific, Inc.


text: Any system failure, security breach or cyberattack on the Company and/or any service provider of the Company could cause the Company to suffer financial loss, disruption to its business, including its trading capabilities and its ability to transfer payments, increased operating costs, liability to third parties, regulatory intervention and reputational damage, among other things, any one or all of which could have a material adverse effect on the Company.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: We have established an Information Security team led by our Chief Information Officer, which is responsible for assessing, identifying and managing risks from cybersecurity threats. Managing cybersecurity risk has been integrated into our overall risk management system and is a priority that we monitor and review regularly with our Board of Directors. The Information Security team works closely with our Legal team to make determinations whether a cybersecurity incident has occurred and whether the incident has materially impacted or is reasonably likely to materially impact us. If a cybersecurity incident is deemed material, the incident is communicated to various members of the Alarm.com leadership team and with the Board of Directors. The Board of Directors oversees our overall risk management system, including cybersecurity risks. A member of the Information Security team presents at quarterly Board meetings and discusses specific risk areas, including those relating to cybersecurity.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology and Senior Manager of Information Technology. Combined they have more than 35 years of experience in IT and cybersecurity. They hold many industry certifications in areas including Risk Management, Cybersecurity, Digital Forensics, Networking, and Enterprise Architecture. Their previous positions include work in Security Operations Centers and cybersecurity consulting for Fortune 500 companies and critical infrastructure providers.

companyName: CHIMERIX INC


text: We also have a dedicated Director of Information Security (or DIS), who reports to our CIO and chairs our Cybersecurity Committee, comprised of internal Information Technology (or IT) IT experts who continuously review risks and vulnerabilities and execute cybersecurity initiatives. Our CIO, DIS and other members of our IT team have extensive experience in managing company-wide information security programs. Our CIO has over 20 years of experience in IT management and a Bachelor of Science in Advance Technical Studies/Computer Information Processing. Our DIS has over 25 years of experience in IT/OT Security, including as a cybersecurity consultant, Supervisory Control and Data Acquisition (SCADA) Network and Security Architect and Security Analyst/Security Engineer.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.

companyName: FLOWERS FOODS INC

ticker: FLO


text: In accordance with our internal policies, our Chief Information Officer, Chief Legal Officer and Vice President of Risk Management, are tasked with certain oversight and management responsibilities related to the monitoring, prevention, mitigation and remediation of cybersecurity threats and incidents. These management members report to the Audit Committee, and the Audit Committee reports to the full Board of Directors, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of efforts to strengthen our information security systems, assessments of our cybersecurity risk management processes, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties. These individuals enable the Company to implement measures that help reduce and address the cybersecurity and data protection threats the Company faces. Such measures include, but are not limited to, disaster recovery and business continuity, solution monitoring, network resiliency and simplification, sensitive data security, employee training and testing, system functionality and stability, infrastructure upgrades and more.

companyName: WillScot Holdings Corp

ticker: WSC


text: Our product security efforts are informed in part by key tenants of various industry security standards such as ISA 62443, UL 2000-1, and certain standards from the National Institute of Standards & Technology ("NIST"). As part of our efforts, we conduct risk assessments and prioritize security validation for certain of our products. For example, we conduct security testing and remediation on a risk-based prioritized basis prior to releasing certain products into the market, as well as periodically post-release to discover potential issues in code, firmware, and protocols and to consider potential security patches or future version updates. We have received SOC 2 certifications for some of our products and software offerings and continue to strive to meet similar requirements for other digital offerings.

companyName: DOVER Corp

ticker: DOV


text: We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader risk management framework.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: We continue to work with third-party cybersecurity vendors to assist us in best practices for implementing strengthened cybersecurity procedures. All Company employees and third-party vendors are instructed to promptly report any suspected breach of its security measures that may affect our Company to the Senior Director, Head of IT. Our Chief Financial Officer and Senior Director, Head of IT provide periodic briefings to the Audit Committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third-parties, and related matters. The Audit Committee provides regular updates to the full Board of Directors on such reports.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their risk profile.

companyName: AUDACY, INC.


text: Our Board of Directors is actively engaged in overseeing our cybersecurity and information security program. Our Board of Directors receives regular reports during board meetings from our CCO on our and our Adviser's and Administrator's efforts concerning information security and addressing information technology and cybersecurity risks no less than quarterly and regularly receives updates from third parties on various business risks, which include cybersecurity matters. The reports are distributed to our Board of Directors, and our CCO engages in detailed discussions with the independent board members during the independent members' session. The reports cover all potentially material cybersecurity threats facing us, as well as key risks and mitigation efforts undertaken by us and our Adviser and Administrator. As significant threats or events are identified by management or the ISP between regular reporting periods, our CCO will inform our Board of Directors immediately and keep it informed as to the developments of assessing the risks, mitigating efforts, and potential disclosure. Appropriate members of management and third-party providers will be involved as deemed necessary based on the potential impact.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: Under the oversight and guidance of the IT Committee, the Board of Directors, and the HR Department's ISO Job Description, the ISO is responsible for the following: • Overall security/control of the network and computing systems. • For coordinating the education and training of new and existing employees on Network and Physical Security Policies as outlined in the Information Systems Security Policy. • Management of all detection systems directly connected to the Internet/network and subjected to on-going review of generated reports and risk assessments performed by independent auditors and vulnerability identification software. • Management of the audit function, which will periodically review the information security policies, standards, and procedures and ensure the adequacy of information system controls and compliance. • Provide reports to the IT Committee, Senior Management, and the Board of Directors, as needed or required, concerning the Bank's security posture. • Oversight and management of technology vendors and suppliers.

companyName: River Financial Corp

ticker: RVRF


text: Our Board of Directors is responsible for overseeing the Bank's business and affairs, including risks associated with cybersecurity threats. The ERM Committee ("ERMC") of the Board has primary responsibility for overseeing the Bank's comprehensive ERM program, including its cybersecurity program. The ERM program assists the Executive Management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in both Audit Committee ("AC") and ERMC meetings.

companyName: Primis Financial Corp.

ticker: FRST


text: The Chief Executive Officer, with the assistance of the other members of the executive leadership team, is responsible for, among other risk management measures, implementing measures designed to ensure the safety standards for personnel, information technology systems and data security, the environment and property in performing the Company's operations. The Company's Enterprise Risk Management Committee (ERM), sponsored by the CEO, was established to oversee the risk management processes and to report upon and ensure that sound policies, procedures and practices are in place for the enterprise wide management of the Company's material risks and to report the results of the Committee's activities to the Company the Board at least annually. These include risks associated with cybersecurity and any of the topics identified in our materiality assessment. Responsibilities for risk management and compliance are distributed throughout various functional areas of the business, including but not limited to a Compliance Committee established to understand and support business integrity and compliance efforts globally, and to oversee Bristow's compliance efforts with respect to COBI, relevant policies, and applicable laws.

companyName: Bristow Group Inc.

ticker: VTOL


text: Our Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the ISO, who has extensive cybersecurity program management experience working in various information security roles, including teaching as an information security instructor at a University. The ISO holds various information security qualifications, such as a doctoral degree in information technology and cyber security and holds the Certified Information Systems Security Professional ("CISSP") certification. The ISO and Chief Risk Officer are responsible for managing the disclosure and communications related to cybersecurity incidents. Our Chief Risk Officer chairs the Management Compliance and Risk Committee independently and has more than 20 years of experience in compliance and risk management.

companyName: OP Bancorp

ticker: OPBK


text: For their new cybersecurity section in Form 10-Ks, companies should confirm compliance with the new line item requirements in Item 106 of Regulation S-K, as summarized below.

companyName: Energy & Water Development Corp

ticker: EAWD


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see "Risk Factors."

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: Specific controls that are used to some extent as part of the information security program include endpoint threat detection and response, privileged access management, logging and monitoring involving the use of security information and event management with monitoring by a security operations center, multi-factor authentication, firewalls and intrusion detection and prevention, vulnerability and patch management, and security awareness training for employees and long-term consultants. Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, we have used third parties to conduct independent assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: GUESS INC

ticker: GES


text: We engage with third parties to separately conduct cyber assessments on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics are utilized to identify potential vulnerabilities. We recognize that third parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To manage third-party risk, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers. As noted, we also conduct tabletop exercises to identify gaps in our supply chain resilience so we can implement improvements.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We regularly engage with third parties, including cybersecurity experts, to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory reviews. Additionally, the Bank seeks to identify, monitor and prioritize substantial risks from cybersecurity threats associated with our use of critical third parties. As part of its risk assessment, the Bank endeavors to use the information obtained from these efforts to reach a reasonable conclusion as to that third party's cyber risk management protocols.

companyName: Federal Home Loan Bank of Chicago


text: Our cybersecurity program (the "Cybersecurity Program") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, (3) vulnerability management program and (4) detection and response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • policies, procedures and standards that are utilized to outline expectations, guidelines and best practices for managing cybersecurity risks; • cybersecurity awareness training for our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical information technology service providers, suppliers, and vendors.

companyName: AMERICAN AIRLINES, INC.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our computer systems, or those of any of our CROs, manufacturers, contractors, consultants or other third parties or potential future collaborators, may fail or suffer security incidents or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personal data, including that of our employees, consultants and clinical trial participants (Information Systems and Data).

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.

companyName: TFF Pharmaceuticals, Inc.


text: The Head of Internal Audit reports to the Chair of the Audit Committee and has twelve years of experience with internal audit oversight and risk management. The Head of Internal Audit and the Chief Operating Officer have overall responsibility for the Company-wide risk management program.

companyName: ThredUp Inc.

ticker: TDUP


text: Additionally, the Company maintains an Information Security Program designed to prevent, detect, and respond to cyberattacks, and maintains a cybersecurity incident response plan designed to enable the Company to respond to cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify clients and customers, as applicable. The Company's risk and technology teams, led by the Company's CRO and CTO, respectively, are responsible for leading the incident response team, identifying technology and cybersecurity risks, utilizing management's expertise in assessing the materiality of cybersecurity events, and are responsible for the controls to manage threats. The Company's risk team in conjunction with the broader incident response team conduct periodic tabletop exercises and business continuity simulations to train and align on best practices and assessment of potential cyber events. Management utilizes the incident response plan and incident response team to assesses materiality of any cyber event through a qualitative and quantitative assessment. The information security program and overall cybersecurity risk management processes are aligned and integrated into the Company's overall risk profile and appetite through the Company's Enterprise Risk Management Committee.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: MANNKIND CORP

ticker: MNKD


text: As part of our routine and periodic overall risk management system or processes, we have incorporated various processes related to cybersecurity. Key cybersecurity controls, such as access controls, are included within our internal control framework that we assess annually as part of Management's Annual Report on Internal Control Over Financial Reporting. Additionally, periodic discussions are held with outsourced IT professionals for both corporate and consolidated plant environments to determine if appropriate actions are being taken to address potential risks. Through the assistance of our qualified third-party IT professionals, we have implemented numerous security measures, including, but not limited to, multi-factor authentication on critical systems, password requirements, access controls, and data encryption. Our IT policies and procedures include the expectations of all employees and all third parties who may be given access to our IT systems to maintain the security of our IT systems.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: To our knowledge, and as of the filing date on this annual report, risks from cybersecurity threats, including potential risks arising from previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to materially affect Chubb's business strategy, results of operations, or financial condition. For more detail regarding cybersecurity threats, see our risk factor titled "A failure in our operational systems or infrastructure or those of third parties, including due to security breaches or cyber-attacks, could disrupt business, damage our reputation, and cause losses" under Item 1A.

companyName: Chubb Ltd

ticker: CB


text: Cybersecurity Threat Monitoring and Incident Response GoDaddy monitors for threats to our information systems on an ongoing basis through a combination of automated intrusion detection monitoring solutions, review of log data, and other related activities. We also require security training for all GoDaddy personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents that are not captured through our monitoring solutions. We also provide mechanisms for interested third parties, including security researchers and law enforcement to provide us notice of potential cybersecurity threats.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.

companyName: IMMERSION CORP

ticker: IMMR


text: Incident Response Plan The Company maintains and tests its Incident Response Plan, or IRP, to appropriately document plans for identifying, prioritizing, containing, and communicating information related to an incident. The Company completes annual tabletop testing of its IRP, including a testing results review to identify opportunities for improvement.

companyName: YORK WATER CO

ticker: YORW


text: Identification, Protection and Detection. Valley maintains a threat team and internal committees to identify any new threats and risks to its information systems. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile through various methods including, for example, using manual and automated tools, subscribing to threat intelligence reports and services, analyzing threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: The Company has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; and an incident response program documenting cybersecurity incident response and notification procedures. The Company's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Information Security Review Committee (ISRC) and the Information Systems Steering Committee (ISSC). The ISO has several years of professional experience in cybersecurity and vendor management, and holds multiple relevant professional certifications. The ISO provides an update to the Board of Directors on a quarterly basis. The Information Security Program is approved by the Board annually.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: In fiscal year 2024, we achieved our primary cybersecurity risk management objective of having no material cybersecurity incidents. Over the past three years, we have not experienced any material information security breaches and have not incurred material expenses from cybersecurity incidents, including those arising at third parties.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: We use third-party service providers to perform a variety of functions throughout our business, such as: conducting nonclinical and clinical trials; supplying certain raw materials, compounds and components; delivering materials to our facilities; and shipping products to our customers. Additionally, we rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and content delivery. Third-party service providers we rely on include: application providers, distributors, hosting companies, supply chain resources, contract research organizations, and contract manufacturing organizations. Our vendor assessment process is generally limited to reputational due diligence of the vendor and, in some cases, examination of the vendor's security certifications.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our security strategy, policies, and procedures as well as possesses expert knowledge in the execution of the related controls and safeguards. Our Chief Information Officer (CIO) has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors. While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs. Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework as well as implements cybersecurity control systems and solutions. This cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Certified Information Security Manager, Microsoft Certified Cybersecurity Architect Expert, Graduate Certificates in Enterprise Cybersecurity and Data Science, Security+ and Certified Information Systems Auditor.

companyName: Meritage Homes CORP

ticker: MTH


text: An independent third-party also assesses and reports on 26North's internal incident response preparedness, adherence to best practices and industry frameworks, and compliance with applicable laws and regulations. The external independent third-party helps identify areas for continued focus and improvement. Finally, 26North carries cyber security insurance that provides a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.

companyName: 26North BDC, Inc.


text: Management, including the CIO and CISO, regularly reviews with the Board of Directors and the Audit Committee the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Audit Committee outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Principal Financial Officer ("PFO") who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: IT leaders and compliance officer are responsible for developing and implementing appropriate cybersecurity programs and ensuring our compliance with applicable laws and regulations. These leaders, equipped with relevant degrees, certifications, and extensive work experience, are informed by their cybersecurity teams about ongoing efforts to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: Outdoor Holding Co

ticker: POWW


text: We recognize the importance of safeguarding our business operations, sensitive data, and intellectual property from cyber threats and other technological risks. Our operations involve the use of various information technology systems, including those for production management, customer order management, and financial reporting. As such, we are exposed to a range of cyber risks, including but not limited to data breaches, ransomware attacks, unauthorized access to proprietary data, and disruptions to our operations due to system failures. We are committed to maintaining an appropriate level of cybersecurity to mitigate these risks. Lendway's cyber environment at December 31, 2024 consisted primarily of outsourced information technology ("IT") operations. The outsourced providers have a cybersecurity framework which includes multiple products implemented to ensure the security of Lendway's and Bloomia's environments. Our third-party service providers alert management, specifically the CFO and CEO of Bloomia, to incidents or other concerns. Management reports significant incidents or concerns to the Audit Committee.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including frameworks such as the Center for Internet Security's Critical Security Controls and the Federal Financial Institutions Examination Council's Cybersecurity Assessment. We periodically engage third-parties to assess our cyber risk program and technical controls. To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have implemented an incident and event response program. That program, which is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, is integrated within our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. An ongoing enterprise-wide security awareness training program is in place to help protect our data, systems, and networks from malicious attacks and cyber threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as unauthorized occurrences, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardize the confidentiality, integrity, or availability of those systems or any information residing therein) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: In November 2023, the Company appointed its first CIO, Phil Stevens, who served as both a CIO and Chief Technology Officer in previous roles, prior to joining the Company. Mr. Stevens has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing various cybersecurity programs. Mr. Stevens holds a Bachelor of Science (B.S.) in Computer Science from Purdue University, a Master of Science (M.S.) in Information Technology from the Florida Institute of Technology, and specializations in AI Product Management and Machine Learning Operations (MLOps) from Duke University (Online).

companyName: Janus International Group, Inc.

ticker: JBI


text: Management and Strategy we are in our early stages of our business plan, we regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to the our cybersecurity processes and practices, which are integrated into our overall risk management system. As we progress with the development of our business plans, we plan to use various security tools designed to help us identify, investigate, resolve and recover from security incidents in a timely manner.

companyName: CalEthos, Inc.

ticker: GEDC


text: Vetting the cybersecurity controls of vendors and partners to ensure that their practices align with our standards for protecting sensitive information.

companyName: cbdMD, Inc.

ticker: YCBD


text: We periodically conduct assessments of cybersecurity risks to identify potential vulnerabilities and threats to our systems and data. These risk assessments are designed to help identify material risks from cybersecurity threats to our critical systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. To date, risks from cybersecurity threats have not materially affected our company.

companyName: Southern States Bancshares, Inc.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and, as discussed below, periodically to the Technology Committee of our board of directors.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks. The Audit Committee of the board oversees our risk management program on behalf of the Board of Directors, which focuses on the most significant risks. Audit Committee meetings include discussions of any specific risk areas which are significantly increasing or which are of particular concern and at least once a year a third party expert in cybersecurity works with the Audit Committee and our Information Management team to assess the processes and controls we have in place around cybersecurity We have introduced corporate policies and training on these policies for all of our staff. Our Information Management team, and in particular our information security team together with the corporate compliance team are responsible for ensuring compliance with these corporate policies. Our Chief Operating Officer and Compliance Offic er oversees our policies and is primarily responsible to assess and manage material risks from cybersecurity threats, with assistance from third party experts as appropriate and our legal team. Our Global VP of Information Management has overall responsibility for our day to day cybersecurity procedures. We also have a Director heading up our global security and cybersecurity team and a dedicated member of the team overseeing cybersecurity threats and activities. Together those individuals have over 20 years of combined experience of information security.

companyName: Adaptimmune Therapeutics PLC


text: As part of our cybersecurity program, we employ a range of security mechanisms and controls throughout our technology environment, which include the use of tools and techniques designed to search for cybersecurity threats and vulnerabilities, as well as processes designed to address such threats and vulnerabilities. We also engage a number of external service providers with additional knowledge and capabilities in cybersecurity threat intelligence, detection, and response. When appropriate, we leverage partnerships with relevant government entities, law enforcement agencies, and industry information sharing forums, such as the Financial Services Information Sharing and Analysis Center ("FS-ISAC"), to further inform our understanding of the threat environment and how to effectively defend the Company against such threats. These defenses include, among other things, a range of cyber educational initiatives that we design and deliver to employees across the enterprise to promote best practices for protecting our information and data, and reporting cyber threats and other risks to corporate systems, data, and facilities. Employees are required to annually certify their completion of training on both cybersecurity and data privacy, and our cyber education program implements targeted testing and training focused on high-risk populations and responding to an evolving threat landscape.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: The Company's management has day-to-day responsibility for managing cybersecurity risks. The management team includes our Chief Financial Officer, who has cybersecurity expertise through prior leadership positions in networking and software businesses, and our Senior Director of Information Technology, who has formal data security training and certifications. In addition to using industry-standard tools to monitor cybersecurity risks, management receives direct reporting of cybersecurity threats from our employees, who are trained annually on cyber security risks and reporting.

companyName: Turtle Beach Corp

ticker: TBCH


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.

companyName: AVISTA CORP

ticker: AVA


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by our audit committee and relevant members of our executive leadership team on at least an annual basis.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately twenty years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Our business is managed under the direction of our Board of Directors ("the Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our Board views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities. To that end, the Board assures that we maintain robust corporate governance policies designed to promote our culture of uncompromised integrity that have been implemented in a manner that facilitates active oversight and engagement regarding various cybersecurity matters. Consistent with these policies, the Board receives updates regarding cybersecurity threats and events in connection with its regularly scheduled meetings, as appropriate, and as part of its ongoing strategy and risk management sessions, engages in discussions regarding cybersecurity threats to our operations. In addition to this direct oversight, the Board has delegated oversight responsibilities with respect to cybersecurity risks to the Audit Committee of the Board. In addition to its oversight of the quality and integrity of the Company's financial statements and internal audit functions, the Audit Committee is also responsible for reviewing the Company's key risk areas, including cybersecurity risks, and regularly receives updates regarding cybersecurity threats and incidents involving the Company or our vendors and suppliers.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: The security program is managed and monitored by a dedicated Information Security team, which is led by our Vice President of Global Information Security, the Company's designated Chief Information Security Officer ("CISO"), and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent, detect, respond, and recover from data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we have adopted a risk-based approach to security which includes continuous risk assessments, vulnerability scans and periodic penetration and testing. We perform due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee training on cyber and information security, among other topics. Our security program is subjected to independent external audits annually to evaluate the effectiveness of our security program and identify areas for continuous improvement.

companyName: GAN Ltd


text: Our management and our advisor are responsible for establishing and monitoring the integrity and effectiveness of our controls and other procedures, which are designed to ensure that all information required to be disclosed is recorded, processed, summarized and reported accurately and on a timely basis, and all such information is accumulated and communicated to management and the audit committee, as appropriate, to allow for timely decisions regarding such disclosures. The controls and procedures subject to the board's oversight include processes related to managing material risks from cybersecurity threats. Accordingly, our cybersecurity processes have been integrated into our overall processes.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO. With over 30 years of experience in the field of information systems and cybersecurity, our CIO brings a wealth of expertise to this role. His background includes extensive experience as an enterprise CIO and his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program as such items relate to cybersecurity. Our CIO manages our cybersecurity risks with the help of key personnel overseeing cybersecurity, information technology networks and infrastructure, operational technology, and critical software applications.

companyName: Liberty Energy Inc.

ticker: LBRT


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer, with support from our information security partners, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: The CIO has served in various roles in information technology for over 25 years, including serving as the Chief Information Officer and in a variety of senior technology roles at public companies. The CISO has served in various roles in information technology and information security for over 30 years, including previously serving as the Chief Information Security Officer of a large public company in the banking industry. In addition, the CISO held executive roles in information technology and cyber security development for the U.S. Department of Defense for over 20 years. The CISO holds a graduate degree in information and communication sciences and has attained the professional certification of Certified Information Systems Security Professional ("CISSP").

companyName: AGILITI, INC. \DE


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our Company. For further discussion of risks from cybersecurity threats, see the section captioned "A disruption, breach, or failure in the operational systems or infrastructure of our third-party vendors or other service providers, including as a result of cyber-attacks, could adversely affect our business" in Item 1A. Risk Factors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: The Incident Response Team ("IRT") coordinates and aligns key resources and team members during a security incident to minimize impact, restore operations as quickly as possible, and assess and fulfill the Company's legal and contractual obligations. The IRT is also responsible for centrally managing internal and external communications to ensure that disclosures are accurate and complete. The IRT is led by our Chief Compliance Officer, legal team, and Cybersecurity Response Leader, and is supported by a multi-tier team comprised of key stakeholders across the business including finance, HR, our dedicated IT provider, and other external response partners, including cybersecurity consultants, cybersecurity insurance providers, and outside legal counsel. The IRT and external response partners operate under the supervision of our executive management team with oversight from the Audit Committee of our Board of Directors.

companyName: ContextLogic Inc.


text: Role of Management Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes. Our CISO also oversees the Cybersecurity Incident Response Team ("CSIRT"), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary. We utilize a security incident response framework that is led by our CISO and supported by the CSIRT with the goal of both ensuring timely notification to our management and the Audit Committee, or the Board of Directors as appropriate, and mitigation of cybersecurity incidents. Our CISO also sits on our Disclosure Committee.

companyName: Aramark

ticker: ARMK


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our incident response plan. A representative of our third-party information technology provider is a member of the incident response team. Our third-party information technology provider takes the lead on assisting us with the steps and procedures to contain the incident. If our third-party information technology provider is unable to contain the incident, we expect to work with our CTO/CISO and cybersecurity insurer to engage the appropriate vendor for containment.

companyName: LXP Industrial Trust

ticker: LXP


text: Our management is responsible for the day-to-day oversight and management of our enterprise risks, including risks from cybersecurity threats. As described in "Risk Management and Strategy" above, primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Technology Officer and dedicated information security team, who develop, prioritize, and execute our cybersecurity strategy in partnership with relevant departments and business units. Our Chief Technology Officer, who has over 20 years of information technology experience including cybersecurity and information security, oversees our cybersecurity framework and reports to our management-level information technology steering subcommittee and management-level enterprise risk management committee. Our Chief Technology Officer is assisted in this oversight role by additional members of management.

companyName: Beneficient

ticker: BENF


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These material risks are managed across us, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program. Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.

companyName: BTC Digital Ltd.

ticker: BTCT


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. Our information security program is integrated into our overall risk management systems and led by our Data Protection Officer. This program is on par with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Internal employees as well as third party advisors are involved in the development and continued maintenance of our cybersecurity program. We also hold cybersecurity insurance as part of our risk management program.

companyName: Globalstar, Inc.

ticker: GSAT


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer, or CTO, to develop and advance the firm's cybersecurity program strategy, which applies to us.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: We maintain a risk-based approach to identify and oversee cybersecurity risks, including risks presented by authorized service providers who have access to our systems or information. We have processes in place to assess and manage associated cybersecurity risks, which include conducting due diligence on the cybersecurity profile of the third party provider and, in cases where PII is shared, ongoing cybersecurity and privacy obligations that are documented in data processing agreements. Our online learning platform is hosted by major cloud-hosting providers, and we require such providers and other third parties that have access to PII or certain other highly sensitive data to be independently SOC 2 attested and/or ISO 27001 certified to ensure that such service providers conform to our security standards.

companyName: Coursera, Inc.

ticker: COUR


text: We are not aware of any cybersecurity threats or incidents that have materially impacted us during the fiscal year ended September 30, 2024, or that are reasonably likely to materially affect our business, including our business strategy, results of operations or financial condition. We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, phishing, extortion or other scams. Although we make efforts to maintain the security and integrity of our systems, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a cybersecurity incident or disruption, and there can be no assurances regarding the effectiveness of our security efforts and measures or those of our third-party providers who have access to, transmit, or store such data. For additional information regarding our cybersecurity risks, see our risk factors under Item 1A in Part I of this Annual Report.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: In addition, our Sponsor's Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: Roadmap and Risk Assessment We have a cybersecurity roadmap, which was first implemented in 2020, that provides a framework for prioritizing and managing our ongoing cybersecurity program. We conduct periodic risk assessments based on the National Institute of Standards and Technology ("NIST") cybersecurity framework to identify and assess our cybersecurity risks, vulnerabilities and information security maturity assessments to evaluate the maturity stage of the overall cybersecurity program. The results of these assessments are reported to the Audit Committee of the Board and we adjust our cybersecurity roadmap, policies, processes and practices as necessary based on the information provided by these assessments as well as the monitoring, testing and auditing noted below.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: We are an essential critical infrastructure business, and cybersecurity is a high priority for our leadership and Board of Directors. In 2021, the Transportation Security Administration (TSA) began releasing security directives establishing cybersecurity requirements for our industry. We promptly responded to these directives when released and continue to work collaboratively with our government counterparts to improve security throughout our technology systems.

companyName: ONEOK INC /NEW/

ticker: OKE


text: KKR's Chief Information Security Officer (the "KKR CISO") leads an information security team (the "KKR information security team") whose responsibilities include securing data from unauthorized use or access. The cybersecurity strategy and program at KKR's asset management business includes, among other things, annual employee training about cybersecurity risks and new employee onboarding about KKR's security policies.

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: Our Board of Directors addresses the company's cybersecurity risk management as part of its general oversight function. Our Risk Committee is responsible for overseeing the company's cybersecurity risk management program, including accepting, transferring, or mitigating cybersecurity risks as appropriate. In addition, we have established an Executive Security Council (ESC). The ESC oversees and governs our cybersecurity program.

companyName: Everpure, Inc.

ticker: PSTG


text: Our cybersecurity risk management program is informed by industry standards and includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. We have a process designed to monitor and address identified cybersecurity risks. To support our cybersecurity risk management program, we leverage a managed security service provider (MSSP) and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response and vulnerability management and to perform periodic penetration testing, and other vulnerability analyses.

companyName: Vigil Neuroscience, Inc.


text: Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Real Estate Net Lease Trust


text: Our business operations rely on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data. Our information and operational technology networks, those of our operators and managers, and those of third parties on whom we rely, are important to our ability to perform day-to-day operations of our business. As a part of our cybersecurity risk management program, we review the various different Company policies that cover cybersecurity on an annual basis and have implemented procedures for responding to cybersecurity incidents. We provide training and awareness programs for all employees of Manager that includes periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls. We have implemented network monitoring, containment and incident response tools, vulnerability management processes and penetration testing. We also actively engage with key vendors and third-party advisors and consultants that assist us with identifying, assessing and managing cybersecurity risks to our business and employ processes to detect and monitor unusual network activity. In connection with our use of third parties, we employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at such vendor or service provider.

companyName: LandBridge Co LLC

ticker: LB


text: See also Item 1A. "Risk Factors – Risks Related to our Business - Failures or security breaches of our information technology systems could disrupt our operations and negatively impact our business".

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our General Counsel and Chief Compliance Officer, Vice President, Information Technology and Associate Director of Information Technology Operations, and Chief Operations Officer.

companyName: G1 Therapeutics, Inc.


text: We have established and maintain comprehensive incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: PGE has a threat intelligence and insider risk program to stay abreast of emerging cybersecurity threats. The Company's threat identification process begins with the development of an inventory of critical enterprise processes and critical assets, which allows the Company to prioritize focus in the event of a threat. PGE's Security Operations Center detects unauthorized entities and actions on the networks and in the physical environment, including personnel activity. Processes are tested regularly, through reviews, audits, and assessments. In addition, cyber security resiliency is enhanced through regular functional and tabletop exercises.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: Engage Third-parties on Risk Management Due to the difficulties and evolving nature of cybersecurity threats, AppTech engages with external experts, including cybersecurity consultants and auditors to evaluate and test its risk management systems.

companyName: AppTech Payments Corp.

ticker: APCX


text: Our program addresses physical threats caused by infrastructure failures, logical threats caused by threat-actors and viruses, as well as other threats we identify by auditing our operations. We conduct annual assessments of our internal control over financial reporting as required for compliance with the Sarbanes-Oxley Act of 2002. Additionally, we conduct annual self-assessments and annual third-party penetration testing of our cybersecurity controls such as for compliance with Payment Card Industry ("PCI") standards, and otherwise where applicable. Our cybersecurity team also monitors supply chain and third-party cybersecurity risks to minimize the likelihood of business disruption, as well as conducts annual incident response plan rehearsals and risk assessments based on NIST standards, including the CSF.

companyName: Cable One, Inc.

ticker: CABO


text: In particular, the Audit Committee reviews with management the Company's key IT Systems and evaluates the adequacy of the Company's information security program, compliance, and controls.

companyName: OptimizeRx Corp

ticker: OPRX


text: As part of our cybersecurity risk management, we regularly assess risks from cybersecurity and technology vulnerabilities and monitor our information systems for potential threats. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. In light of the industry in which we operate and our processing of sensitive information, we engage external auditors to annually assess our internal controls governing our services and data, to conduct a payment card industry data security standard review of our security controls protecting payment information, and to perform third-party penetration testing of our payment information and related systems. In addition, we engage third-party service providers to monitor our information storage and systems and to conduct evaluations of our security controls, including independent audits. The results of these independent audits are reported to our management who then report to the Audit and Risk Committee.

companyName: Sezzle Inc.

ticker: SEZL


text: As noted above, we also maintain a Cybersecurity Steering Committee, or CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Executive Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Senior Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC group has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of the cybersecurity initiatives within Lumentum and is responsible integrating cybersecurity risk management practices with critical business processes so that cybersecurity is appropriately addressed throughout Lumentum.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Our Data Privacy Officer is responsible for leadership, compliance, and oversight of applicable cyber and privacy laws and policies, which are designed to protect data belonging to our employees and customers and the Company's information security; while our IT Cyber Incident Management Team oversees Bristow's cyber incident response and remains in close contact with the Executive Leadership Team and the Audit Committee throughout the cyber incident resolution process.

companyName: Bristow Group Inc.

ticker: VTOL


text: Periodically, at least annually, ORIX USA's CTO and/or other members of the ORIX USA Information Technology and Cybersecurity Team will present to the Audit Committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: The Board of Directors are informed of cybersecurity risks and provide oversight to the executive management team with the day-to-day responsibility of cybersecurity functions, auditing and budget. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to impair data confidentiality, integrity and/or availability. In the event of an incident, we intend to follow our customized incident response playbooks, which outline the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate. Our procedures vary slightly depending on the type of incident at issue (e.g., account compromise, malware, data loss) as well as the data compromised.

companyName: Altair Engineering Inc.


text: The Board of Directors provides supervision of cybersecurity risks to ensure the security of our company's operations. The Board of Directors receives updates quarterly on cybersecurity threats, vulnerabilities, and incidents from management from the Chief Digital Officer and IT Manager. These updates include information on the prevention, detection, and remediation of cybersecurity incidents, as well as monitoring key performance indicators, such as the effectiveness of security controls and overall cybersecurity posture.

companyName: Altus Power, Inc.


text: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CIDO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Company's Board of Directors (the "Board") plays a pivotal role in overseeing risks arising from cybersecurity threats within the Company. The Board exercises oversight by adopting a Written Information Security Program, engaging in discussions, reviewing reports, and seeking updates on the Company's cybersecurity posture. The Board's Risk Committee oversees and monitors the Bank's enterprise risk management practices. The Risk Committee assists the Company's Board of Directors with monitoring the Company's information technology and cybersecurity plans and policies, in addition to compliance with information security and technology risk management requirements, including reporting related to the SEC's cybersecurity disclosure rules.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Our Information Technology General Controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us, including prompt escalation and communication of major security incidents to senior business leadership and our Board of Directors.

companyName: MEDICINOVA INC

ticker: MNOV


text: The Information Security Executive Sponsors Committee (the "Executive Sponsors Committee"), chaired by our Director of Information Security, includes IT, legal, compliance and other business leads. The Executive Sponsors Committee provides a forum for these cross-functional members of management to consider existing and emerging cybersecurity risks; review cybersecurity regulations; determine cybersecurity project prioritization; approve, review, and update policies and standards, as appropriate; and promote cross-functional collaboration to manage cybersecurity risks across the enterprise to support the Company's goals and address cybersecurity risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Our information technology team is responsible for assessing and maintaining our cybersecurity risk management program and may engage third-party experts on an as-needed basis for risk assessment and system enhancements. Our information technology team are experienced information systems security professionals with many years of experience in the information technology field and various degrees and cybersecurity-related certifications.

companyName: Forward Industries, Inc.

ticker: FWDI


text: As part of our annual enterprise risk assessment, technology cybersecurity risks are ranked and reviewed by management. In the event of a cybersecurity incident, the Vice President of Information Technology would prepare a comprehensive assessment for management that summarizes potential and actual impacts and includes any steps needed to remediate the identified issues. If the cybersecurity incident was deemed to be material by management, the Vice President of Information Technology would brief our Board of Directors on the matter, at which time determinations would be made by the Board of Directors on the need to report or disclose the cybersecurity incident to our customers or investors.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We value the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Nuwellis, Inc.

ticker: NUWE


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Senior Director of Information Security, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance to Rumble On. We are finalizing our IT Risk Management Program that will outline the steps to be followed in the event of an incident, from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate.

companyName: RideNow Group, Inc.

ticker: RDNW


text: Our CISO reviews and contributes to the cybersecurity risk reporting that is provided to the Audit Committee of our Board on a quarterly basis. The quarterly updates include cybersecurity risk assessment results, which include risks associated with the use of third-party service providers, and cover efforts to mitigate previously identified risks. Our CISO also oversees the cybersecurity incident response team and is responsible for updating our Board on any cybersecurity incidents, including the mitigation and remediation of these incidents, should they occur.

companyName: Toast, Inc.

ticker: TOST


text: The coverage provides protection up to $1 million above a deductible of $50,000 for various cybersecurity risks including liability, business interruptions, cybercrimes and privacy breach related incidents.

companyName: Unique Logistics International, Inc.


text: Our CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. Our CAO has 25 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in our IT/OT cybersecurity, data security, and physical security environment and risk profile.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Our board of directors, in coordination with our Audit Committee, oversees our risk management program, including the management of cybersecurity threats. Our board of directors and our Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. Our board of directors and our Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with our Information Systems Representative and other members of senior management.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on iBio's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: iBio, Inc.

ticker: IBIO


text: Vanguard Green Investment Limited acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Our Senior Vice President - Technology has served in various roles in information technology and information security for over 25 years. He holds undergraduate and graduate degrees in computer science and business.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: We have not previously experienced any cybersecurity risk or cybersecurity incident which has been determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our or our CMOs', CROs', manufacturers', contractors', consultants' or collaborators' cybersecurity".

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced any cybersecurity incidents that resulted in a material effect on our business, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third -party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "We are regularly subject to cybersecurity and other similar attacks. If our security measures are breached or unauthorized access to customer data is otherwise obtained, our platforms may be perceived as insecure, we may lose existing customers or fail to attract new customers, our reputation may be harmed, and we may incur significant liabilities."

companyName: Skillsoft Corp.

ticker: SKIL


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. Our IT leadership reports to our Chief Executive Officer (CEO)

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: We rely on sophisticated information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management and strategy program, which is integrated in our enterprise risk management program.

companyName: Avantor, Inc.

ticker: AVTR


text: A multi-layered approach and methodology designed to protect and monitor data and manage cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted by independent cybersecurity vendors who specialize in application and network penetration testing, threat emulation, social engineering, and best practice gap assessments. Our IT Risk and Cyber Security department conducts regular audits and assessments to identify, evaluate, and manage cybersecurity risks. As a result of these assessments and audits, we endeavor to update IT infrastructure, technical controls, procedures, policies, and education programs to improve resilience to cybersecurity threats.

companyName: Enviva, LLC


text: The board of directors receives prompt and timely information from the Security Incident Response Team, which includes the CRO, CIO, ISO, and Director of Information Security, among others, as set forth in the Security Incident Response Plan, on any cybersecurity or information security incident that may pose significant risk to FHLBank and continues to receive regular reports on the incident until its conclusion. The board of directors, Risk Oversight Committee and Operations Committee each receive regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the board discusses cybersecurity and information security risks with the ISO and CRO.

companyName: Federal Home Loan Bank of Topeka


text: We maintain a dedicated, fully staffed and qualified Information Security team that reports to the office of the Chief Technology Officer (CTO) and is currently led by the Director of Information Security (InfoSec). Combined, these individuals have more than 50 years of experience related to corporate information security governance, data and network security, data governance, risk management, and overall have implemented a risk management process and formed a Risk Management Committee, which consists of members of our management team, including members with technical expertise, to identify, evaluate and categorize any potential InfoSec risks. perform vulnerability testing and penetration testing at routine intervals to assure that our InfoSec posture remains vigilant. utilize and maintain third-party security vendors, as necessary, to provide assistance with a variety of security efforts.

companyName: Rumble Inc.

ticker: RUM


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Forza's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Forza X1, Inc.