text: The management team ensures the implementation of robust monitoring protocols for preventing, detecting, mitigating, and remediating cybersecurity threats. We use a 'defense in layers' approach which constitutes a cybersecurity strategy that involves the use of multiple types of securities measures, each designed to protect against a different vector of attack. As noted above, management is supported by third-party monitoring, next-generation hardware, and automated logging analysis. We utilize third parties for penetration testing and log evaluation, which provides 24/7 network monitoring to assist in rapid identification and mitigation of any suspicious network access. We maintain an Incident Response Plan, based on guidance within the National Institute of Standards and Technology's Computer Security Incident Handling Guide, which provides an escalation policy for identified security incidents. Our escalation policy details specific escalation processes by which senior leadership (Director of IT, Chief Financial Officer, and Chief Executive Officer) are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Preservation of evidence related to system modifications; and Continued collaboration with external specialists to aid in the ongoing evaluation of existing policies and procedures. Establishment of a dedicated cybersecurity governance committee; Standardization of cybersecurity incident response procedures and formats; Conducting penetration tests on a quarterly basis; Enhancement of segregation of duties to mitigate the risk of self-review of transactions within the system;

companyName: High Roller Technologies, Inc.

ticker: ROLR

secItem: Item 1C


text: At least annually, we conduct a third-party information security audit focusing on internal and external network security protocols and penetration testing, as well as internally managed ad hoc testing as needed. Simulations and tabletop testing of our business continuity and Incident Response Plans are performed on a routine basis and assist with our associates' familiarity and preparedness for an event. Any gaps or improvement areas identified by routine testing are addressed in a timely manner to help improve future testing and response.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the President who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements: • Systems Safeguards. We adopt the "trust by design" framework when designing new products, services and technology. We employ a variety of administrative, preventative and detective controls and tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. • Incident Response. We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. • Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness. • Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber-attacks, and recovery and resilience tests. • Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.

companyName: BANC OF CALIFORNIA, INC.

ticker: BANC


text: The mission of our information security program is to design, implement, and maintain a comprehensive information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. Our information security program is comprised of internal and external security and technology professionals who work collaboratively to identify, assess, manage, and mitigate cybersecurity risks and threats across the Company, our subsidiaries, and third-party contractors.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.

companyName: Aimco OP L.P.


text: Despite our efforts to prevent security incidents, (i) some of these attacks have resulted in security incidents (although thus far we do not believe that any of these incidents has resulted in a material adverse effect on our operating results or financial condition) and (ii) future security incidents are likely (some of which could have a material adverse effect on our operating results or financial condition). See Item 1A "Risk Factors" for a further discussion of cybersecurity risks.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our Information Security Officer is responsible for managing our information security program, inclusive of cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business continuity. Some of these responsibilities are carried out in collaboration with other internal departments, such as the information technology department. In any case, the Information Security Officer provides guidance, oversight, and monitoring of the information security program, and acts in an independent role, reporting directly to the Chief Operations Officer and subsequently to the Audit and Examination Committee of the board of directors. Our Information Security Officer has extensive bank operations experience, has attained Certified Banking Security Manager certification with the banking industry, and attends relevant cybersecurity training sessions on a regular basis. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ an in depth, layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected persistent threats. Notwithstanding the strength of our defensive measures, the threat from cybersecurity attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not experienced a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our customers and third party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology based products and services by us and our customers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Our CIO and CISO provide updates to the Audit Committee, and our VP of Product Security provides updates to the QRC, multiple times per year regarding our cybersecurity risk management program, including the results of third-party assessments, progress toward cybersecurity goals and objectives, product cybersecurity matters, third-party risk management, regulatory compliance and other topics as needed. We also have processes by which certain cybersecurity incidents and breaches are escalated and reported to the Board of Directors or a Board committee, as appropriate, based on our management's assessment of risk.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Together with our Director of Information Technology, BDO reports frequently to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.

companyName: LXP Industrial Trust

ticker: LXP


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.

companyName: American Strategic Investment Co.

ticker: NYC


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through the Company's information systems, the SIRT will communicate the cybersecurity threat or cybersecurity incident and any damages to the CIO and other members of senior management of the Company. The Company will assess the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such exercises, if material, are reported to the audit committee of our board and our board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our Chief Information Security Officer ("CISO"). Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.

companyName: SolarWinds Corp


text: We have experienced and expect to continue to experience cyber threats and incidents, though as of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, cybersecurity threats are continually evolving, and the possibility of future cyber incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: The Company's Information Security Officer ("ISO") is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO works in concert with members of the Information Technology ("IT") Department, including the Bank's Chief Information Officer ("CIO"), to ensure the execution of the Programs. The aforementioned individuals meet with management on a monthly basis through an IT Steering Committee in which management assesses IS and IT risk.

companyName: LAKE SHORE BANCORP, INC.


text: Third-Party Consultants and Auditors We use uses third-party auditors and consultants in connection with obtaining and maintaining industry certifications for certain products and services. We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents. Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.

companyName: GoDaddy Inc.

ticker: GDDY


text: The Board of Directors receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board of Directors, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and best practices for mitigating emerging threats; • progress on cybersecurity projects; • incident reports; • updates from past event(s); and • adherence to regulatory requirements and/or industry standards, as appropriate.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: One of the key functions of our Board is the informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function through its audit committee.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A.–Risk Factors–Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.

companyName: New Mountain Guardian IV BDC, L.L.C.


text: Primary responsibility for assessing cybersecurity risks rests with our audit committee of the Board, who work together with our management team, including our chief executive officer and our president and chief financial officer to manage cybersecurity risk.

companyName: MOBIX LABS, INC

ticker: MOBX


text: Technical Safeguards and Continuous Monitoring As part of our cybersecurity program, we regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. We utilize data analytics to detect anomalies and search for cyber threats. Our cybersecurity processes include a continuous monitoring system which supports comprehensive cyber threat detection and response capabilities and complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. Cyber partners are a key part of Holley's cybersecurity infrastructure. We partner with leading cybersecurity companies, leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in our environment.

companyName: Holley Inc.

ticker: HLLY


text: Annually, the CISO prepares the Bank's Annual State of Security report which is provided to executive management, OROC, and the Board of Directors. The report provides data on, and insights into, the top security concerns facing the Bank, such as shifts in the threat landscape, high-priority threats, and trends affecting the banking industry, in addition to security-specific technology changes which have occurred during the current year that could impact the overall risk to the Bank. The report also includes an assessment of the upcoming threats that the Bank could potentially face over the course of the next year and includes recommendations designed to mitigate those threats.

companyName: Federal Home Loan Bank of Dallas


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of our third-party vendors, collaborators or other contractors or consultants, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to a material disruption of our product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm and other adverse consequences."

companyName: Vor Biopharma Inc.

ticker: VOR


text: Training and Preparedness The Company mandates ongoing cybersecurity training for all employees, covering a broad range of relevant topics. High-risk roles receive additional specialized training. We conduct regular phishing and social engineering simulations, with organization-wide reporting of results. Leadership teams also participate in annual tabletop exercises (simulated security incidents) to reinforce preparedness and refine our response plan. In addition, we maintain cybersecurity insurance to provide an added layer of protection and support in the event of a significant cybersecurity incident.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: We have a vendor risk assessment process to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. These processes consist of the distribution and review of questionnaires designed to identify cybersecurity risks associated with the engagement of third parties. We also periodically audit cybersecurity practices of certain third-party service providers.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all employees on cybersecurity standards and provide monthly training on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. We use advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we periodically engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.

companyName: Crane Co

ticker: CR


text: Our Head of IT meets regularly with our Chief Operating Officer to discuss our cybersecurity threat landscape, address open gaps and issues, and evaluate solutions to cover any identified gaps. Our Head of IT, in collaboration with members of senior management, reports relevant cybersecurity matters to our Audit Committee. For discussion of cybersecurity risks, please see Item 1A, "Risk Factors."

companyName: Invivyd, Inc.

ticker: IVVD


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. Cybersecurity threats, and their evolving nature, may pose a risk to us and our strategy, results of operations, and financial condition in the future.

companyName: PubMatic, Inc.

ticker: PUBM


text: Management's Role Managing Risk Our CISO is responsible for the implementation, operation and monitoring of our cybersecurity risk management program. Our current CISO, who reports to our CIDO, has over 20 years of experience managing the information technology and cybersecurity operations within large, global organizations. His extensive experience assessing and mitigating cybersecurity risk, implementing governance structures and developing employee training programs is critical in developing and executing our cybersecurity strategies.

companyName: ENTEGRIS INC

ticker: ENTG


text: Our Cybersecurity and Information Services (IS) department executes and measures the delivery of the cybersecurity program and incorporates the program into the governance and internal controls framework for our Company. We engage third parties such as consultants, auditors and specialists to support, evaluate, and improve the program, and utilize cybersecurity technologies and services to prevent, identify, detect, respond, and recover from cybersecurity threats and incidents. We also maintain a third party security program to identify, prioritize, assess, mitigate and remediate third party risks, which is part of our overall cybersecurity risk management framework.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: We maintain a cybersecurity program employing many components and strategies to mitigate and remediate day-to-day cybersecurity threats and exposures. We approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security, integrity, and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required. Our layered approach to cyber security risk mitigation includes the following: • Secure architectural solution design of processes and system configuration. • Assessment and remediation of cybersecurity events with potential impact on business processes. • Proactive monitoring and mitigation of active exploits through managed services. • Evolution of the information security governance program. COMPASS MINERALS INTERNATIONAL, INC.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: The Committee receives briefings from our information security team ("Information Security") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 22 years of experience in information security that includes key roles managing cybersecurity risk in both government and the private sector. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that comprises senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.

companyName: Carlyle Group Inc.

ticker: CG


text: Chief Executive Officer and Chief Financial Officer are primarily responsible for timely updating the Board of Directors and the Audit Committee about any material cybersecurity incidents or threats or any cybersecurity related issues worthy of their attention.

companyName: MARIZYME, INC.

ticker: MRZM


text: Our program also includes a comprehensive incident management process intended to promptly identify, evaluate, respond, remediate, and recover from cybersecurity incidents including the preparation, detection, analysis, communication, eradication, and containment of such incidents including those associated with third-party service providers. The identification, assessment and response functions related to information security are managed by an incident response team, which is responsible for maintaining and operationalizing our incident response plan.

companyName: PRA GROUP INC

ticker: PRAA


text: December 31, 2024 Our Trustees consider cybersecurity risk as part of its risk oversight function. Our Trustees oversee management's implementation of our cybersecurity risk management program. Our Trustees will receive periodic reports from management on our cybersecurity risks as well as updates, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems.

companyName: LUB LIQUIDATING TRUST


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Park's Audit Committee oversees its cybersecurity risk assessment, risk management and risk mitigation policies and programs. Park's Enterprise Risk Management ("ERM") Committee reports to the Audit Committee and is responsible for identifying Park's cybersecurity risks. Park also has a dedicated Risk Management team that reports to the ERM Committee, which includes representatives from several departments, external consultants and insurance professionals who interface with brand and management partners to assist with risk mitigation at our properties. Additionally, we have engaged third-party service providers to assist with risk mitigation activities, implementing security monitoring capabilities designed to alert us to suspicious activity, and developing an incident response program that is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident. Our cybersecurity incident response plan requires prompt notification of senior management in the event of a cybersecurity incident that has affected or is expected to affect the Company and prompt briefings on subsequent developments as appropriate. We have undertaken table-top risk exercises and employees participate in mandatory annual trainings and receive communications regarding the cybersecurity environment to increase awareness throughout the Company. The Company's cybersecurity program is based on the U.S. National Institute for Standards and Technology Cybersecurity Framework. We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Bioxytran. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: The Bank's cybersecurity strategy involves continuous monitoring of threats, maintaining updated defense mechanisms, and training employees on best practices in cybersecurity. The Bank engages with third-party experts and utilizes advanced cybersecurity tools to enhance defenses against emerging threats. The Bank also performs regular penetration testing, incident response planning, business continuity testing, and system audits to ensure the ongoing strength of its cybersecurity systems. The Bank utilizes a trusted third party to monitor for suspicious activity, including escalation procedures. The Bank also maintains cyber liability insurance that includes activation and escalation procedures should an incident occur.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: Our Board of Directors has overall responsibility for enterprise risk management and has delegated the oversight of cybersecurity risks to the Audit Committee. The Company's Chief Financial Officer ("CFO") immediately updates the Audit Committee on any significant cybersecurity incidents and/or threat that may require an 8-K filing. Furthermore, the CFO reports quarterly to the Audit Committee on any significant cybersecurity incidents, threats, mitigation strategies and controls at each Audit Committee meeting. The Audit Committee then updates the full board on significant matters raised and discussed during these sessions.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: Blackbaud also maintains a defined program and dedicated team that provides security oversight of its third-party service providers. This program assesses and manages risk at the onboarding phase of engagement with third-party vendors and partners as well as oversight throughout the lifecycle of the vendor relationship.

companyName: BLACKBAUD INC

ticker: BLKB


text: The audit committee receives periodic updates from the CFO and finance department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See "Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions." for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Lafayette Square USA, Inc.


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—Risks Related to Our Business—We face risks regarding our information technology and security".

companyName: Mistras Group, Inc.

ticker: MG


text: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Director of Information Security, who each have over 24 years of experience in IT, including various leadership roles at other large corporations. One of the three members of our Audit Committee is a cybersecurity expert.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: Our CISO has routinely reported to the Audit Committee of our Board of Directors at the Audit Committee's regular quarterly meetings, or more frequently as needed. The Audit Committee's duties include, among other things, oversight of risks related to cybersecurity, as well as our broader ERM program. The Audit Committee communicates regularly with our full Board of Directors, which is ultimately responsible for overall risk oversight for Progress.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: Our incident response plan, as effected by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.

companyName: Talkspace, Inc.

ticker: TALK


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated Information Security team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. In the process of advancing the systematic development of information security, we seek to maintain a robust approach that encompasses policy formulation, organizational structuring, technological application enhancement, process optimization, and personnel training. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Board Oversight of Cybersecurity. Our Audit Committee, acting pursuant to authority delegated by our full Board of Directors, actively oversees our cybersecurity strategy and risks from cybersecurity threats, as well as our broader enterprise risk management framework. Our cybersecurity team meets biweekly to assess and manage material risks from cybersecurity threats and vulnerabilities, which includes reviewing our risk profile and developing mitigation strategies with respect to those risks. We utilize vulnerability management software, which helps us identify risks within our environment. Our Audit Committee meets quarterly to review cyber security compliance initiatives as they are escalated from our cybersecurity team through management and reviews the enterprise risk matrix prepared by management on an annual basis. Our Information Security Manager has over 15 years of cybersecurity experience in information security and holds CISSP, CRISC, and Security+ certifications and has a MS in Information Assurance. Our Enterprise Risk Committee is briefed quarterly on cybersecurity threats and mitigation strategies by security. Updates include incident trends, compliance status, and responses to emerging threats. Additionally, real-time alerts ensure immediate awareness of critical cybersecurity events.

companyName: EVgo Inc.

ticker: EVGO


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, overseen by our internal risk management and information technology functional areas, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Oversight of cybersecurity is integrated into the responsibilities of the Board. The Nominating and Governance Committee (the "NGC") has been assigned oversight of cybersecurity matters, particularly as they relate to financial risk and controls, integrity of financial data and public disclosures, and security of overall digital data.

companyName: Progressive Care Inc.


text: Directed by Envestnet's Group Head, Cybersecurity/Information Security Officer, the Information Security team defines, implements and monitors our Information Security Program. We review and approve our security policies, procedures, and standards annually or whenever material updates are made during the year. Moreover, we undergo SOC 1 Type 2, SOC 2 Type 2, and PCI-DSS (where applicable) audits on multiple technology platforms. In addition to our Information Security team, we use third-party vendors to help address material risks from cybersecurity threats. Among other things, third parties conduct security assessments, monitor endpoint security, probe our defenses, and conduct cybersecurity exercises. We also leverage third-party providers to aid management to detect, respond and recover in the event of a cyber incident.

companyName: ENVESTNET, INC.


text: Engagement and Oversight of Third-parties We have contracted a reputable, global third-party external Security Operations Center ("SOC") to ensure that cybersecurity processes, tools, and monitoring are operating continuously. The SOC service provides a holistic view of our security landscape using a cloud-native Security Incident & Event Management platform, removing security siloes to gain actionable insights and providing continuous 24/7 detect and response services, as well as proactively identifying threats to prevent security disruptions.

companyName: AGREE REALTY CORP

ticker: ADC


text: We seek to maintain a robust and continuously improving cybersecurity program however the impact of certain cybersecurity incidents could have a materially adverse impact on our competitive position, reputation, operations and/or financial position. We remain vigilant in continuously improving our cybersecurity program and its controls.

companyName: Third Harmonic Bio, Inc.


text: Our approach to cybersecurity risk management includes the following key elements: • Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from penetration testing and bulletins published by CIS to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Incident and Event Management ("SIEM") system provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technologies, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. • Insider Threats – We maintain an insider threat program designed to identify, assess, and address potential risks from within the Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access participate annually in required training, including spear phishing and other awareness training. • Supplier Engagement – We require our suppliers to comply with our standard information security terms and conditions, in addition to any requirements from our customers, as a condition of doing business with us, and require them to complete information security questionnaires to review and assess any potential cyber-related risks depending on the nature of the services being provided.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: The ISO manages our security vendor risk management program. Each vendor's cybersecurity risk is ranked using a risk tiering calculator. The calculator is designed to provide a consistent methodology for evaluating key risk factors, such as the type of service or product the vendor provides and the location and classification of data. For high- and moderate-risk vendors, an assessment is completed that includes reviewing external audits and certifications (e.g., SOC 2 Type 2 audit, ISO 27001 and associated Statement of Applicability, or FedRAMP). As needed, an industry-standard questionnaire is completed by the vendor and the results assessed by ISO in an effort to ascertain the vendor's information security maturity and overall posture. High-risk vendors are re-evaluated annually while moderate-risk vendors are evaluated every three years. Ongoing monitoring is in place for all high and moderate risk vendors using an external service that rates the cybersecurity posture of corporate entities using a scored analysis of cyber threats.

companyName: MAXIMUS, INC.

ticker: MMS


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: In an effort to deter and detect cyber threats, we annually provide all employees with cybersecurity and prevention training, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: CURIS INC

ticker: CRIS


text: We have engaged external cybersecurity professionals to help design and manage our security program. These experts conduct annual penetration testing and incident response tabletop exercises, make recommendations on how to continuously improve our cybersecurity program, and assist us in implementing their recommendations into our existing processes.

companyName: Leafly Holdings, Inc. /DE


text: Network Security Policy (the "NSP"). The NSP aims to protect the integrity of the Company's data by securing the systems and devices that make up the Company's network infrastructure. Pursuant to the NSP, the Company: (i) enforces strict password-construction criteria for network devices; (ii) requires employees to verify their identities using multi-factor authentication to access internal resources; (iii) maintains and reviews logs from application services, network devices, and critical devices and requires the retention of logs in accordance with the Company's Retention Policy; (iv) implements and configures firewall technology to filter both inbound and outbound network connections; (v) authorizes the IT Manager to determine the extent and scope of external security testing to be performed; (vi) establishes a software-use policy; and (vii) requires antivirus and anti-malware software to be used and timely patched and updated on any Company-provided devices.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader including employees and external third-party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; awareness training of our employees, incident response personnel, and senior management;

companyName: SurgePays, Inc.

ticker: SURG


text: Chief Operating Officer and IT consultant provide periodic briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and similar issues. Our audit committee provides regular updates to the Board of Directors on such reports.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: We conduct an enterprise risk assessment that is updated on an annual basis and includes periodic monitoring of new and emerging risks and preparation for and progress on mitigation efforts. Cybersecurity is directly integrated into this process as an operational risk and has been classified within the enterprise risk management program based on the risk assessment. Any identified gaps are incorporated and monitored through a cybersecurity roadmap, with progress reported to management. Controls put in place to manage any identified risks are evaluated against an established risk-mitigation framework.

companyName: ANSYS INC


text: Strategy and Management Oversight We have an enterprise risk management function responsible for the oversight and assessment of ongoing and emerging risks to our business operations and the integrity of our data, including the impact of cybersecurity risks. Our enterprise risk management team maintains a steering committee that oversees and opines on our processes to identify, prioritize and assess key risks, including risks related to cybersecurity. The steering committee is composed of senior leaders with visibility into our key risks. Such members have expertise in the areas of risk management, business strategy, information technology, cybersecurity, legal and compliance, finance, and business products, among others. In partnership with other stakeholders, this steering committee monitors risk exposures, promotes risk-management strategies, and implements acceptance and notification criteria. The activities of the steering committee are overseen by the Audit Committee of our Board (the "Audit Committee").

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our Director, Information Security Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of cybersecurity incidents. They perform an impact assessment with respect to cybersecurity incidents meeting certain criteria and elevate the review of any such cybersecurity incidents for review by our executive officers.

companyName: CoreCivic, Inc.

ticker: CXW


text: We face risks associated with security breaches through cyberattacks, cyberintrusions or otherwise, and other significant disruptions of information technology networks and related systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: As part of its overall enterprise risk management framework, the Company maintains both an Information Security Committee ("ISC") and an Incident Response Plan ("IRP"). The Company's ISC is managed by its Chief Information Officer (the "CIO") whose team (the Incident Response Team, or "IRT") is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The purpose of the IRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific cybersecurity incident. These objectives are designed to maximize the effectiveness of the Company's response through an established plan of action and assigning responsibilities to appropriate personnel and/or third-party contractors.

companyName: Solo Brands, Inc.

ticker: SBDS


text: Our Audit Committee, in connection with the Board of Directors, maintains oversight of our Enterprise Risk Management framework, including oversight over our cybersecurity and information technology policies and programs.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Board of Directors Oversight and Reporting The Audit Committee of our Board of Directors reviews the Company's risks related to data privacy, cybersecurity, and information technology. The Audit Committee periodically reviews and assesses the adequacy of the security for the Company's information systems and the Company's contingency plans in the event of a systems breakdown or security breach. The CISO reports to the Audit Committee twice per year and to the Board of Directors once per year on cybersecurity risks, activities, policies and procedures.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: The Risk Management Committee ("RMC") and the Technology Committee of our Board of Directors oversee the company's approach to managing cybersecurity risks. On a quarterly basis, the Board committees receive a comprehensive update from management on our cybersecurity risk management strategy. This includes information on emerging threats, the company's cybersecurity posture, progress toward risk mitigation goals, significant cybersecurity incidents or developments, and the steps management has taken to address these risks. During these sessions, the Board committees typically review materials detailing current and potential risks, as well as the company's capacity to mitigate those risks. The committee also engages in discussions with our Chief Information Security Officer and Chief Information Officer about these matters. Additionally, Board committee members are encouraged to engage in ongoing, informal conversations with management regarding cybersecurity news and updates to our risk management and strategy initiatives. Material cybersecurity risks are also reviewed during Board discussions on key topics such as enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, and brand management. Three individuals on the Board of Directors have deep technology expertise, while one of those individuals is responsible for leading cloud security at a Fortune 50 technology company.

companyName: WAFD INC

ticker: WAFD


text: We exercise risk-based due diligence in selecting our third-party service providers, including, as appropriate, review of vendor applications, general IT controls and the IT facilities used to service MetLife's business. Third parties are governed by the MetLife Third-Party Risk Management program, which includes risk assessment prior to onboarding. Based on the assessment of risk, certain third-party service providers must periodically update relevant assessment documentation and be reevaluated by MetLife relative to their internal controls. Vendors deemed critical and high risk are continuously monitored by various industry solutions and services designed to identify cybersecurity risks.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Cyber Risk Management Strategy The Board of Directors is responsible for overseeing Tyler's senior management in the execution of its risk-management responsibilities and for assessing Tyler's overall approach to risk management. The Board exercises these responsibilities periodically as part of its meetings and through its committees, each of which examines various components of enterprise risk. The Audit Committee oversees management of financial risks, as well as Tyler's policies with respect to risk assessment and risk management, including but not limited to information security risk.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The Corporation's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally across the Corporation and report cybersecurity incidents to appropriate levels of management, including senior management, and the Audit Committee or Board of Directors, based on potential impact. The Corporation conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, the Corporation exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate, and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The Corporation takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.

companyName: EXXON MOBIL CORP

ticker: XOM


text: The CRO, CIO, and CISO each have over 15 years experience in managing cybersecurity, information technology and other risk management processes. The following is a summary of the CRO, CIO, and CISO's experience: • The CRO, a member of RGA's Executive Committee, has held various positions in the Company and is responsible for oversight of operational risks, which includes cybersecurity. The CRO has more than 30 years of experience and has held various positions including serving as the Company's Global Chief Risk Officer. In addition to overseeing the overall risk governance structure of RGA's Enterprise Risk Management program, the CRO has extensive experience leading a number of cybersecurity programs at the Company such as enhancing the Company's cybersecurity systems to ensure compliance with Privacy and Security Regulations. • The CIO, a member of RGA's Executive Committee, leads the strategic direction of the Company's information technology resources and management of RGA's global information technology operations. The CIO has held various positions of responsibility at other companies for all aspects of technology and he has deep knowledge in organizational change, digital transformation, core platform and data analytics modernization. • The CISO, who is responsible for implementing the Company's cybersecurity risk management strategy, oversees the Company's global security team ensuring broad awareness of emerging risks and cybersecurity threats. The CISO has significant cybersecurity experience including executive management responsibility in cybersecurity, operational risk management, and information technology, including regulatory compliance and risk quantification.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: Moreover, Duke Energy's processes ensure that the Board of Directors receive contemporaneous reporting on potentially significant cyber events including response, legal obligations, and outreach and notification to regulators and customers when needed, as well as an opportunity to provide guidance to management as appropriate.

companyName: PROGRESS ENERGY INC


text: Our Incident Response Plan, coordinated through the Senior Information Security Officer, provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation. The Incident Response Plan includes key members of executive and senior leadership, facilitates coordination across multiple parts of our organization, and is evaluated regularly.

companyName: SIERRA BANCORP

ticker: BSRR


text: The Company has designed a third-party risk management program, under the supervision of its Chief Data Privacy Officer, that is designed to manage third-party providers through the lifecycle of the relationship. This includes assessing the vendors based upon their criticality and inherent risk, analyzing the risk posed, performing due diligence prior to contract execution, and conducting annual monitoring of risk and performance. Due diligence activities include an assessment of the minimum cybersecurity controls (specifically, data handling practices, encryption, and cybersecurity event management) to enable the Company to verify that third-party controls meet our expectations and contractual commitments.

companyName: SAUL CENTERS, INC.

ticker: BFS


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 17 years.

companyName: GAIA, INC

ticker: GAIA


text: Leveraging external threat intelligence and collaborating with industry peers, regulatory bodies, and national cybersecurity agencies to adapt to emerging threats. Embedding security into software development through deployment, with regular code reviews, SDLC checkpoints, and secure architecture principles. Reviewing governance practices, incorporating lessons learned from incidents, audits, and tabletop exercises to refine policies, controls, and strategic priorities.

companyName: Zedge, Inc.

ticker: ZDGE


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company.

companyName: JUNIPER NETWORKS INC


text: Our Security Awareness Program includes training that reinforces our information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by Company-wide testing initiatives.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have been immaterial.

companyName: Covista Inc.

ticker: CVSA


text: Securing the information of our customers, employees, contractors, and third-party service providers is important to us. We have adopted physical, technological, and administrative controls on data security, and have defined procedures for data incident detection, containment, response, and remediation. While everyone at our company plays a part in managing these risks, oversight responsibility is shared by our board of directors, our Audit Committee, and management. To facilitate coordinated supervision of cybersecurity matters, our management team provides regular cybersecurity updates to our board of directors and regular updates on cyber risk management, which include development regarding our cybersecurity program, broader cybersecurity trends, evolving industry standards, the threat environment and other topics, to the Audit Committee. Together with management, our Audit Committee and board of directors consider this information in their review of our cybersecurity risks and response to data breaches. We also maintain information security risk insurance coverage.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: The Security Director and the Chief Information Officer ("CIO") have primary responsibility for informing the Audit Committee on cybersecurity risks. They provide periodic briefings to the Audit Committee, which may include topics such as updates regarding the cybersecurity threat landscape, the status of ongoing cybersecurity-related initiatives and strategies, and regulatory requirements.

companyName: IROBOT CORP

ticker: IRBTQ


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical IT Systems, information, products, services, and our broader enterprise IT environment;

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: As part of our risk management processes, we have an enterprise-wide cybersecurity program aligned to the NIST Cybersecurity Framework. Our program is a risk-based program designed to protect our information systems through multiple defenses and layers of security, commonly referred to as a "Defense in Depth" approach. Key elements of our program include:

companyName: Zoetis Inc.

ticker: ZTS


text: Matters determined to present potential material impacts to the Company's financial results, operations, and/or reputation are immediately reported by management to the Company's Board of Directors or its Audit Committee, as appropriate, in accordance with its escalation framework.

companyName: OneMeta Inc.

ticker: ONEI


text: Our policies, practices, and standards for addressing material risks associated with cybersecurity are integrated into our overall risk management and are based on industry standards including the National Institute of Standards and Technology ("NIST") which aligns the prevention techniques, identification, protection, detection, response, and recovery related to an incident. These controls are tested by our information security organization and by independent third parties. We actively engage with industry groups for awareness of best practices and our third-party providers for industry benchmarking of critical areas within our cybersecurity posture.

companyName: Freshpet, Inc.

ticker: FRPT


text: The Audit Committee of the Board has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. Our Audit Committee is composed of members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of employee training programs, multiple resources to manage and monitor the evolving threat landscape, effective board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, Mr. Gharib and the audit committee of the board of directors evaluate material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: The Bank's Security Governance Committee is led by the chief information security officer and has a cross-functional membership comprised of representatives from the Bank's operational risk, information security, information technology, legal, operations, and other departments that provide both specific, technical and multidisciplinary expertise to the committee. The committee has integrated oversight of the information security program, the physical security program, and is responsible for reviewing security policies and procedures, security exceptions and violations, the processes and standards to implement the policies and procedures defined in the cybersecurity risk management program, the Bank's cyber incident response plan, the security awareness program and implementation reports, and for providing guidance and monitor progress on major information security projects, and regulatory changes and requirements.

companyName: Federal Home Loan Bank of Atlanta


text: Our cybersecurity risk management program includes: • Periodic risk assessments are designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.

companyName: Bloom Energy Corp

ticker: BE


text: A dedicated CISO leads the IT/OT Security Team and is responsible for our cybersecurity risk management and strategy. The CISO has over 20 years of experience in security, of which 15 years is specific to cybersecurity and has served as a CISO since 2013, having joined ConocoPhillips as CISO in 2022. The CISO holds a master's degree and is a Certified Information Security Professional. The CISO reports to the CD&IO, who holds a master's degree in information technology and has served as Chief Information Officer/Chief Technology Officer and various roles in information technology for over 28 years. The CD&IO reports to the Executive Vice President and Chief Financial Officer. This management team assesses and manages risks associated with cybersecurity.

companyName: CONOCOPHILLIPS

ticker: COP


text: The Company uses third-party security firms in different capacities to provide or operate certain security measures and controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company also uses a variety of processes designed to address cybersecurity threats and incidents related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations and performance monitoring.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Cybersecurity threats are continually evolving, and no assurances can be given that our risk management systems and processes will fully mitigate all cybersecurity threats and risks.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: The CIO also promptly informs and updates the Company's Board of Directors about any information security incidents that may pose significant risk to the Company. Our guidelines require that any significant cybersecurity matters including strategic risk management decisions are escalated to the Board of Directors to ensure that they have comprehensive oversight. The AFC conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. As part of this review, the Company's cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Company's Board of Directors. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: When we do experience cybersecurity incidents, like the cybersecurity incident we disclosed in February 2024, we aim to utilize that experience to inform and strengthen our information security program.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: We face significant and persistent cybersecurity risks due to the global nature of our business, the use of information technology systems, infrastructure and data in our business operations and our reliance on third-party vendors, suppliers, customers and business partners. We defend our systems against cybersecurity attacks on a daily basis and rely heavily on the reliability, security and efficiency of our information technology systems and ongoing employee training to face these threats. In addition, to protect our business, we have implemented a cybersecurity risk management program with a robust governance structure and strong mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Our cybersecurity governance framework incorporates policies, procedures, regular meetings, and controls to manage and mitigate cybersecurity risks. Aligned with industry standards and regulatory requirements, the framework is overseen and regularly evaluated by our leadership team responsible for implementation. Regular risk assessments are conducted to identify and assess potential cybersecurity risks, informing the development of proactive risk mitigation strategies within the governance framework.

companyName: INNODATA INC

ticker: INOD


text: Due to our heavy reliance on the strength and capability of our technology systems, which we use both to interface with our customers and to manage our internal financial reporting and other systems, we utilize a layered cybersecurity model designed to protect Company systems and sensitive data. This defense model is composed of a variety of different components including administrative, technical controls and safeguards. These various components are centrally managed and monitored creating a multi-layered, interlocking, cybersecurity defense system. We believe this defense system is dynamic and designed to adjust to protect against the latest cyber threats and attack vectors.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, and data processed by us or third-party vendors."

companyName: Palladyne AI Corp.

ticker: PDYN


text: Reputation Risk: A significant cybersecurity incident could damage the Company's reputation and erode customer trust, leading to customer attrition, negative publicity, and loss of business opportunities.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Our cybersecurity and IT executives include our CIO, who has 34 years of experience in Information Technology, including 21 years in the financial services space. His responsibilities as the CIO include all areas of Information Technology and information security oversight. Our CISO, has 19 years of experience in information security. The CISO holds certifications from leading security associations. The information security personnel reporting to the CISO hold various leading security certifications. The CISO, reporting to the CIO, oversees the implementation and compliance of our information security standards and mitigation of related risks. We also have three management level committees and a team that supports our processes to assess and manage cybersecurity risk.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Our SDIS, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance. Such individual has significant relevant experience in the area, including over 27 years of technology experience in various industries with 17 years focused on information security, as well as significant experience working closely with government agencies including the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security. As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, SDIS, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: –Board of Directors – Enterprise risk management ("ERM") process: As part of the ERM process, executive management and the Board of Directors regularly review an assessment related to cybersecurity and data protection risks to identify material risk areas, assess our processes to mitigate those risks, and identify process and procedure improvements to alleviate identified risks, including allocating appropriate resources. Cybersecurity and data protection focus areas of ERM include phishing, malware, data breaches, outdated software, staffing levels for key information technology positions, and risks associated with our use of third parties.

companyName: CEDAR FAIR L P


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings. The Company's CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data protection, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. As needed, the Audit Committee reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations. In addition to this regular reporting, cybersecurity risks or threats may also be escalated on an as-needed basis to the Audit Committee.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: The CISO implements and oversees processes for the regular monitoring of our information systems. We use various tools and methodologies to manage cybersecurity risk that are tested regularly. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. In addition, we engage third-party consultants to conduct annual cybersecurity assessments and to conduct audits for compliance with regulatory, Sarbanes-Oxley Act, Service Organization Control Type 2 and International Organization for Standardization standards. We also engage third parties to assess our cybersecurity maturity and risk management programs.

companyName: STRYKER CORP

ticker: SYK


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. iBio's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: iBio, Inc.

ticker: IBIO


text: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems. We deploy a wide range of security tools across the environment including multifactor authentication, data encryption, cloud-based backups, endpoint monitoring, and dark web monitoring. As a result, we have not identified any material cybersecurity risks and are continuously hardening our environment. Additionally, our program includes regular cybersecurity testing for all employees.

companyName: Cingulate Inc.

ticker: CING


text: TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including the Company. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: Nuveen Global Cities REIT, Inc.


text: Our cybersecurity program leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We have engaged the assistance of third-party experts to conduct comprehensive cybersecurity assessments centered on appraising our alignment with the NIST. Additionally, as further described in Item 1. Business-Regulation-Safety and Security Regulations, TSA has issued a series of security directives that all pipeline owners and operators must include in their cybersecurity planning, testing and in their reporting of any incidents. We have continued to expand investments in cybersecurity, including additional end-user training, using layered defenses, identifying and protecting critical assets, and strengthening monitoring and alerting. We regularly test our cybersecurity defenses by performing simulations and drills at both a technical level (including through penetration testing) and by reviewing our operational policies and procedures with third-party experts. We report the test results to the TSA as required. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our stakeholders, including investors, customers, employees, and vendors. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers based on the potential impact of a disruption of the services to our operations and the sensitivity of data shared with the service providers. The internal business owners of our hosted applications are required to document user access reviews at least annually and receive and review a System and Organization Controls (SOC 1 or SOC 2) report from the vendor. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and evaluate the risks associated with that relationship. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity program.

companyName: GENESIS ENERGY LP

ticker: GEL


text: To further ensure independence and effectiveness, the Board has delegated authority for the conduct of the cybersecurity program, including the referenced reports, to the Technology Risk Management Director. This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Board's Risk and Technology Committee. Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities. The results of these audits are reported to the Board's Audit and Finance Committee, providing an extra layer of assurance and accountability. The Director of Internal Audit reports independently to the Chair of the Board's Audit and Finance Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Threat Management Process. In addition to the regular and routine vulnerability scanning, the Company relies on various threat intelligence feeds for the identification and awareness of potential threats that could impact the Company's environment. Using third party vendors to assist, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the Company environment. We continually enhance the cybersecurity capabilities based on evolving threats. We have adopted an incident response plan that applies in the event of a cybersecurity threat or incident.

companyName: John Marshall Bancorp, Inc.

ticker: JMSB


text: Based on the information available to us through the time of this filing on March 28, 2025, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our cybersecurity risk management processes, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. Refer to the risk factor captioned "Increasing dependence on the continuous and reliable operation of our information technology systems" under

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments, and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the Board, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Cybersecurity Risk Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: APi Group Corp

ticker: APG


text: As a technology and communications company that globally transmits large amounts of information over our networks, we recognize the critical importance of maintaining the security and integrity of information and systems under our control. We view cybersecurity risk as one of our principal enterprise-wide risks, subject to control and monitoring at various levels of management throughout the Company. We dedicate significant resources towards programs designed to identify, assess, manage, mitigate and respond to cybersecurity threats. As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious activities.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kronos Bio, Inc.


text: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information security program, including to conduct risk assessments and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as conducting risk assessments of third-party vendors where the Company has determined it to be appropriate.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: Our cybersecurity risk management program includes: • Cybersecurity incident detection and response plan to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. • Risk Assessment: Our enterprise-wide risk management programs and Information Security Review process is designed to identify, assess, document, monitor and report information security risks. Based on this information, we evaluate the likelihood and impact of harmful events and deliver recommendations regarding a response to risks presented. Feedback from internal audits, external assessments, and industry benchmarks is used to improve our cybersecurity posture. • Training and Awareness: Implementation of enterprise-wide mandatory annual security awareness training for employees, including cybersecurity and data privacy training. We regularly deploy enterprise-wide phishing simulation tests with mandatory follow-up training and education, which are reviewed at least annually and are updated as needed. Additionally, we provide an easy mechanism for employees to report suspicious email messages to the information security team for additional investigation. • Security Tools Optimization: Utilize a variety of tools designed to protect our network and systems, including firewalls, intrusion detection and prevention systems, web content filtering protection, anti-virus and malware detection tools, system scans and full disk encryption. • Third Party Risk: Keysight's Third Party Cyber Risk Management ("TPCRM") is a systematic process for managing exposure to cybersecurity risks throughout the supply chain and developing appropriate response strategies, policies, processes, and procedures.

companyName: Keysight Technologies, Inc.

ticker: KEYS