text: In an effort to mitigate risks related to cybersecurity threats, the Company has also designed and implemented required training for all employees, including training on the Company's security and privacy policies, which are mandatory as part of the onboarding process, with refresher trainings required annually thereafter. Additionally, the Company carries out regular phishing simulation tests throughout the year to keep employees alert, spread awareness and ensure that employees have the knowledge and resources necessary to report suspicious activity.

companyName: INDEPENDENT BANK CORP

ticker: INDB


text: The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST).

companyName: FIRST KEYSTONE CORP

ticker: FKYS

secItem: Item 1C


text: Employee Training and Awareness: We conduct regular cybersecurity training and awareness programs for employees at all levels to ensure they understand and follow best practices in identifying and reporting potential cyber threats, including phishing attacks and social engineering tactics.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: The Company is externally managed by the Adviser and has no employees or internal information systems. As such, the Company relies on the Adviser's risk management program and process, which include cyber risk assessments, as well as other third-party service providers to protect the Company's information from cybersecurity threats.

companyName: First Eagle Private Credit Fund


text: We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us. We are currently developing processes to enhance our vendor management processes.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and EVP of Operations, and Head of Internal Audit has broad oversight of the Company's risk management processes. The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO invites team members from the product and technology groups to attend each Cybersecurity and Governance Council meeting to report on ongoing or relevant cybersecurity and compliance matters. The Cybersecurity and Governance Council reports any material developments to the Audit Committee on a quarterly basis.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: As of the date of this report, we have not been materially affected by any cybersecurity threats, including as a result of any previous cybersecurity incidents. For more detailed information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including "Risks Relating to Legal and Regulatory Matters: A breach of the confidentiality or security of information we or our third-party providers hold or of the security of the computer systems used in or for our business could be detrimental to our business, financial condition and results of operations."

companyName: Vizio Holding Corp.


text: There can be no guarantee that our policies and procedures will be effective. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. We describe the risks from cybersecurity threats in Item 1A - Risk Factors, "Information and Technology Related Risks". We believe that risks from prior cybersecurity threats have not materially affected our results of operations or financial condition, including our business strategy, for the periods covered by this Annual Report on Form 10-K.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: Based on the information available as of the date of this Annual Report on Form 10-K, cybersecurity risks, including as a result of any previous cybersecurity incident, have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, we have seen an increase in cyberattack volume, frequency, and sophistication in the digital environment.

companyName: DEERE JOHN CAPITAL CORP


text: The CIO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, members of the CIO's team are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Company's management team, through ongoing communications with CIO's team, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.

companyName: UNIVERSAL STAINLESS & ALLOY PRODUCTS INC


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. Additionally, in the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: We believe that the conduct of our employees is critical to the success of our information security. Through our security awareness program, we keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes mandatory annual cyber safety training for all users with access to our computer network intended to reduce the likelihood of success of cyberattacks which target our employees. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.

companyName: TEXTRON INC

ticker: TXT


text: To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While CNX maintains cybersecurity insurance, the costs related to cybersecurity threats or incidents may not be fully insured. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: CNX Resources Corp

ticker: CNX


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Investment Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, the Board, and, if needed, the Company adjusts its cybersecurity policies, standards, processes and practices based on the information provided by the assessments, audits and reviews.

companyName: Upland Software, Inc.

ticker: UPLD


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Our Risk Oversight Committee and Audit Committee are responsible for reviewing and approving our Information Security Program, as well as reviewing the quality and effectiveness of our technology security. These committees are also responsible for reviewing the guidelines and policies for assessing and managing our exposure to risks, including cybersecurity risk, and the steps management takes to monitor and control such exposures. The Risk Oversight Committee and Audit Committee periodically meet to facilitate oversight of risk management matters, including cybersecurity risk. For example, at least five times per year, the committees receive updates from the CISO and VP-ISTR on our Information Security Program.

companyName: Discover Financial Services


text: Our Board of Directors oversees risks related to cybersecurity threats to our business directly and through its Audit Committee. The Audit Committee receives regular reports on cybersecurity risks, priorities, and focus areas from our Chief Security and Trust Officer at least four times a year and receives a live presentation at least twice a year. Our Board of Directors also regularly receives updates from the Audit Committee on its oversight activities and, on occasion, receives updates directly from our Chief Security and Trust Officer. Additionally, the Chief Security and Trust Officer provides more frequent updates to the Board of Directors and Audit Committee if necessary due to a cybersecurity threat, incident, or other development.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Our Head of IT has over 20 years of IT experience in the pharmaceutical industry and oversees the cybersecurity program at AnaptysBio. He has experience developing and leading cybersecurity programs for pharmaceutical companies, including experience in evaluating and implementing tools and technologies that enable defense and response capabilities and developing critical cybersecurity procedures and training and awareness programs.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: The Chief Information Security Officer leads the Company's Cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. Our CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). Our Cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. The Cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.

companyName: TPG Inc.

ticker: TPG


text: The Boards of Directors of the Company and Bank and the Audit Committee of the Company are responsible for ultimate oversight of cybersecurity risks managed daily by management pursuant to the Bank's information security program. The Boards of Directors annually approve this information security program and regularly receive a report from the Bank's Information Security Officer that outlines the steps undertaken to protect the information and data assets of the Bank and Company. Additionally, the Information Security Officer updates the Boards of Directors through supplementary reports on issues related to Cybersecurity readiness.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: As directed by the Company, the MSP provides regular training for Company personnel regarding cybersecurity threats as a means to equip such personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage an incident response team based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis. Third Party Service Providers.

companyName: Vuzix Corp

ticker: VUZI


text: The company's Audit Committee and Governance and Compliance Committee provide board oversight of company cybersecurity risks. The Audit Committee conducts a minimum of two cybersecurity program updates per year, including a review of capital spend, budget, and staffing, as well as quarterly reports on cybersecurity threats and key risk indicators related to the company's progress on risk mitigation activities. The Governance and Compliance Committee, as part of its oversight for the enterprise risk management program company-wide, reviews and ensures that the company's oversight and governance structure related to company risks, including cybersecurity risks, remains appropriate and that risks are appropriately managed.

companyName: Corteva, Inc.

ticker: CTVA


text: The ESO is led by our Chief Information Security Officer ("CISO") and seeks to maintain a consistent, resilient, and secure infrastructure by partnering with resources across the Company. The ESO implements numerous cybersecurity processes and capabilities, which include but are not limited to: assessing risk associated with significant infrastructure or operational changes and the introduction of new technologies; administering our third-party service provider risk management program; managing secure software development and change management; managing access management and logical access controls, identifying security vulnerabilities through automated scanning technologies; performing penetration testing and due diligence assessments; and protecting the confidentiality, integrity, and availability of the Company's data in transit. The ESO includes the activities of the Paychex Cyber Fusion Center, which provides 24x7x365 cybersecurity monitoring and incident response. We maintain incident response plans which outline the escalation, investigation, reporting, and overall response procedures depending on the type and severity of incidents.

companyName: PAYCHEX INC

ticker: PAYX


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including if our information technology systems, or the information technology systems of our CROs, our CDMOs, service providers, our current and potential future partners or other third parties with whom we work were compromised, we could experience adverse consequences, including but not limited to material disruptions to our business operations, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, or other adverse consequences.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees.

companyName: American Strategic Investment Co.

ticker: NYC


text: Our IT internal controls are audited by an external audit firm as part of our Sarbanes-Oxley Act compliance activities, and this process includes assessing the design and operating effectiveness of those controls.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Our board of directors has approved various management committees including the IT/Cybersecurity Committee, which provides oversight and governance of the technology program and the information security program, as well as oversight and governance of the Company's data and its storage. This committee is chaired by the CIO and includes various employees within the enterprise information security department, including the CIO and CISO, and other key departmental managers from throughout the entire company, including information technology, risk, compliance, operations and human resources/training. This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security, data risks and incidents. The committee reports its findings to the management Enterprise Risk Committee. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The CISO reports on key issues, including significant cybersecurity and/or privacy incidents, discussed at management committee meetings and the actions taken in connection with those meetings to the IT/Cybersecurity Committee of the board of directors on a quarterly basis (or more frequently as may be required).

companyName: TRICO BANCSHARES /

ticker: TCBK


text: While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company. For further discussion of risks from cybersecurity threats, see the section captioned "A failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers or other third parties, including as a result of cyber-attacks, could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses." in Item 1A. Risk Factors.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Although we are still in the process of developing a formal incident response plan, our team is trained and had practical experience to cover all phases of the incident management process, including identification, containment, eradication, recovery, and post-incident analysis.

companyName: DNA X, Inc.

ticker: SONM


text: Nutex manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.

companyName: Nutex Health Inc.

ticker: NUTX


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. Although we have not experienced cybersecurity incidents, a significant cybersecurity incidence could reasonably have a material adverse effect as against us, such as malware or ransomware attacks or DoS attacks, which could lead to business disruptions, unplanned downtimes or outages, particularly in critical systems or services, may impact our ability to operate efficiently, affecting business continuity.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and a Technology Risk and Information Security Committee (the "Committee") established by the Investment Adviser manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Investment Adviser's Committee to assist with assessing and managing material risks from cybersecurity threats. The Committee is chaired by an outside cybersecurity and information technology expert, and its other members are the Investment Advisors CFO/CCO, its General Counsel, and its Director of Information Technology. The CCO has been responsible for oversight of the Company's overall SEC compliance program, since the Company's inception and has worked in the financial services industry for more than 25 years, during which time the CCO has gained expertise in assessing and overseeing controls regarding risks applicable to the Company.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: We have a cybersecurity program to identify, monitor, and mitigate cybersecurity risks. The security program consists of formal roles and responsibilities for information security and incident response, and is overseen by our IT Steering Committee, which consists of key executives and employees, with guidance from our third-party cybersecurity vendor. Our enterprise risk management program considers cybersecurity risks alongside other company risks, and we consult with subject matter experts to gather information necessary to identify cybersecurity risks, evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. In addition to continuous cyber monitoring, the IT Steering Committee participates in quarterly updates with cybersecurity experts which include reports from these experts on identification of new cyber risks and threats, reported vulnerabilities, trend analysis on attack vectors, and monitoring of risk mitigation activities.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.

companyName: Open Lending Corp

ticker: LPRO


text: Role of Management Through our services agreement with Liberty discussed in Part I, Item 1. "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Our CISO, CIO, chief technology officer, general counsel, and other members of management are part of an executive-level Security Steering Committee, along with subcommittees comprised of cross-functional representatives focused on evaluating ZoomInfo's data governance, cybersecurity incident response framework, security culture, and product and application security, among other areas. Members of the executive-level Security Steering Committee provide updates and analysis regarding cybersecurity, data privacy, and related security topics to the Board's Privacy, Security, and Technology Committee at each meeting. In addition, our legal, privacy, and compliance teams are focused on applicable cybersecurity laws and regulations and monitor changes to such laws and regulations with a view to implementing what we believe are best practices in the industry.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Our institution utilizes industry standard and regulatory approved assessment tools to identify cybersecurity risks and measure preparedness. The tools provide a repeatable and measurable framework for our organization to measure its cybersecurity preparedness over time.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: The Company has established and maintains a cross-functional Cyber Governance Committee that is responsible for helping the CISO prioritize and manage evolving cyber risks and reports to the Company's Chief Information Officer. The Cyber Governance Committee, which oversees the Company's governance and oversight of information security, meets quarterly and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the Cyber Governance Committee. The CISO also provides response and oversight during any significant cybersecurity incidents and informs the Cyber Governance Committee of all cybersecurity incidents that have been identified by the Company to date.

companyName: Vestis Corp

ticker: VSTS


text: We identify and assess cybersecurity incidents based on multiple factors including information from previous events and incidents. The Cybersecurity Incident Response Team ("CSIRT") categorizes events into four levels of severity with defined requirements to assess criticality. The CSIRT informs both our leadership as well as our SEC Cybersecurity Rules Disclosure Committee ("SCRDC"), Cybersecurity and Privacy Council and the Audit Committee of the Board on matters related to cybersecurity risks that are deemed to materially affect the Company.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Management has the responsibility to manage risk and bring to the Board's attention any material near-term and long-term risks to the Company, including risks from cybersecurity threats. We actively engage with key vendors and industry participants and monitor new developments in global cybersecurity concerns as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Our Cybersecurity Steering Committee has developed a standard operating procedure that outlines specific steps to identify, mitigate and report on any cybersecurity-related incidents that may be discovered.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: Internal Cybersecurity Team Our internal cybersecurity team, led by our IT Manager, is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. Our IT Manager has over 14 years in cybersecurity work experience and managing all levels of the Company's on-premises and cloud infrastructure.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Related to Our Business and the Products—Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in this annual report on Form 10-K.

companyName: Acutus Medical, Inc.


text: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our CISO reports to our CIO who, in turn, reports directly to our CEO.

companyName: FLEX LTD.

ticker: FLEX


text: The Vice President of Information Technology receives reports on information security and cybersecurity threats from our Director of Infrastructure and Cybersecurity and in conjunction with management, regularly reviews risk management measures implemented by our company to identify and mitigate information security and cybersecurity risks. A number of experienced information security team members responsible for various parts of the business also report to the Vice President of Information Technology on an ongoing basis. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the VP IT to the Audit Committee and senior management annually. Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.

companyName: CODEXIS, INC.

ticker: CDXS


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect our data's confidentiality, integrity, and availability. We have implemented, including testing software and our computer systems, our facilities, systems and procedures, from cybersecurity threats. We assess risks arising from cybersecurity threats against our information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic assessments to identify such cybersecurity threats.

companyName: MULIANG VIAGOO TECHNOLOGY, INC.


text: Our cybersecurity programs are managed by a team of professionals who monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our cybersecurity team includes personnel that have obtained credentials from the International System Security Certification Consortium and the SANS Institute, such as Certified Information Systems Security Professional (CISSP), as well as experienced information systems security professionals and information security managers.

companyName: Village Farms International, Inc.

ticker: VFF


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats. We have a special email encryption from Google that protect against cyberthreats.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: The Board's Role in Cybersecurity Risk Oversight The Audit Committee of our Board has oversight responsibility related to cybersecurity risk and is briefed quarterly by our Chief Information Officer on cybersecurity risk, our cybersecurity management program and initiatives, and, if applicable, notable cybersecurity events. In the event of a significant cybersecurity incident, our Chief Executive Officer will notify the Chairman of the Board or, in that person's absence, the lead independent director of the Board.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: management and strategy recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced the ordinary course of our business, we collect and store sensitive data, including intellectual property. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management strategy, which is comprised of a wide array of policies, standards, architecture, processes, and governance. Under the guidance and supervision of our Interim Chief Executive Officer, we further limit risk by delegating our information technology and cybersecurity to a leading third-party IT consultant to safeguard our networks. Additionally, as an added layer of security, all of our data is stored on the cloud.

companyName: Sonnet BioTherapeutics Holdings, Inc.


text: The full Board of Directors engages in oversight of UScellular's cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and UScellular's assessment of cybersecurity threats and mitigation plans. The Senior Vice President of Information Technology provides the full Board of Directors an annual update and discussion of the cybersecurity program. The UScellular Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. The Audit Committee meets with the Senior Vice President of Information Technology at least two times per year. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, typically on an annual basis.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: In the event that a cybersecurity incident occurs which results in damage to the Company's data or infrastructure, the Cyber Incident Response Team would follow the Company's Cyber Incident Response Plan. The Cyber Incident Response Plan was developed using the guidelines described in the National Institute of Standards and Technology Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, has been reviewed and assessed by outside experts, is updated annually, and is used to train for cybersecurity incidents. The Cyber Incident Response Plan details the identification, containment, eradication and recovery processes specific to the Company's environment with prioritization of critical assets. The Cyber Incident Response Plan also details emergency actions required to isolate and protect industrial control system environments, should the incident pose a risk to electric or gas operations. The Company participates in annual industry drill exercises to test the Cyber Incident Response Plan.

companyName: UNITIL CORP

ticker: UTL


text: To date, we have no t identified any cybersecurity threats or past incidents that have had, or are likely to have, a material impact on our company's operations, business strategy, financial performance, or results of operations.

companyName: MIRA PHARMACEUTICALS, INC.

ticker: MIRA


text: The Company maintains a cybersecurity program focused on preventing, identifying and mitigating cyber threats applicable to its business, including as a former owner and operator of commercial office properties. Our Board oversees our cybersecurity program through its Audit Committee, which meets regularly with the Company's executive officers and senior personnel from the Company's IT department, which manages the program on a day-to-day basis. The Company's cybersecurity program is integrated into its overall risk management processes.

companyName: EQC Liquidating Trust


text: Our program is based on the National Institute of Standard and Technology("NIST") Cybersecurity Framework and the Center for Internet Security Critical Security Controls ("CIS").

companyName: International Seaways, Inc.

ticker: INSW


text: The cybersecurity risk management and mitigation measures we implement for certain of our IT Systems and Data including for example (1) cybersecurity risk is addressed as a component of our enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board, which evaluates our overall enterprise risk, (4) policies and procedures to manage how Information Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Bancorp has established an Information Security (IS) program, which is overseen by the Director of Information Security and the Information Security Officer. Both of these roles report to the Chief Risk Officer. The IS program is structured upon and informed by the Center for Internet Security Risk Assessment Method (CIS RAM), which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). The primary objectives of the IS program are to protect the confidentiality, integrity and availability of our information assets, comply with applicable laws, regulations, contractual obligations and manage significant risks arising from cybersecurity threats. These processes are integrated into the institution's overall risk management system, ensuring a unified approach to risk mitigation.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Our management has general responsibility for day-to-day implementation of our information technology, cybersecurity, and privacy strategies and policies, including deployment and use of security tools, applications, and annual employee training. Role or project specific employee training, as well as other training, may occur more frequently than annually, as needed. Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are typically led by our Chief Technology Officer ("CTO"), who is assisted by our Chief Information Security Officer ("CISO"). Our CISO, CTO, and our Risk Steering Committee are informed about and oversee the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: ETSY INC

ticker: ETSY


text: The Audit Committee, on behalf of the board of directors, is responsible for oversight of the Company's strategies to assess and mitigate cybersecurity risks, as set forth in the Audit Committee's charter. The Audit Committee receives quarterly or as needed updates from the CTO regarding the cybersecurity risks the Company faces based on the current cybersecurity threat landscape, as well as the status of the measures undertaken by the Company to manage those risks.

companyName: Ladder Capital Corp

ticker: LADR


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors. • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information, as well as risks of data leakage and unauthorized access to sensitive information. • Ongoing review of the controls framework to support the security of emerging technologies, including artificial intelligence (AI) and generative AI (GenAI), ensuring alignment with evolving risks and regulatory expectations.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: Our board of directors, directly and indirectly through its committees, has oversight responsibility for our risk management process, including risks related to cybersecurity. Our board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk assessment and management activities, including with respect to information technology, cybersecurity, and privacy.

companyName: Concentrix Corp

ticker: CNXC


text: The Board's Technology and Innovation Committee assists in the Board's oversight of the company's cybersecurity risk. The Committee monitors and oversees the company's exposure to cybersecurity occurrences as well as the company's approach to managing cybersecurity risk, including how to reasonably control and monitor cybersecurity risks and effectively assign management oversight and responsibility. CarMax's management team, including the CITO and the CISO, provide quarterly updates to the Committee regarding the cybersecurity landscape and the company's security posture in the context of external cybersecurity occurrences as well as updates on the latest issues related to cybersecurity risk as needed.

companyName: CARMAX INC

ticker: KMX


text: Engagement of Third Parties Given the complex and evolving nature of cybersecurity threats, the Company periodically engages third parties to assist us in evaluating our security vulnerabilities and developing and maintaining effective cybersecurity risk management. Partnering with third parties enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes are well-designed and effective. For example, in 2023, we engaged a global law firm to conduct an external assessment of our cybersecurity governance framework and processes and provide recommendations to improve our cybersecurity readiness and posture. We also work with third party specialists who perform threat and vulnerability assessments, such as penetration testing, and develop strategies to mitigate cybersecurity-related risks.

companyName: ENTEGRIS INC

ticker: ENTG


text: Our approach to mitigating information technology and cybersecurity risk comprises a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of our critical IT Systems and information related to our business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, we have aligned our cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines. For example, we have aligned our processes with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and assess our cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKYWEST INC

ticker: SKYW


text: She is an active member of the Greater Pittsburgh CISO Group and the Steel City OTSEC Information Sharing Group, and serves on the Editorial Review Board for two peer-reviewed journals (International Journal of Cyber Research and International Journal of Information and Communication Technology Education).

companyName: UNITED STATES STEEL CORP


text: The FedEx Information Technology Risk Council ("ITRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The ITRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.

companyName: FEDEX CORP

ticker: FDX


text: The security professionals in the IMT have cybersecurity backgrounds and expertise relevant to their roles, including, in certain circumstances, relevant industry certifications. In addition to our internal cybersecurity capabilities, we also have engaged outside experts to assist with assessing, identifying, and managing cybersecurity risks. The IMT meets as necessary to discuss, investigate, and respond to any cybersecurity incidents, to allocate resources to respond to incidents, and to confirm incidents are appropriately documented. We have protocols by which the IMT escalates certain cybersecurity incidents within our company and, where appropriate, the IMT will notify appropriate stakeholders and our Audit Committee and provide updates on the status of the incident. Experienced employees responsible for various parts of our business and a team of trained cybersecurity professionals assist our SRC Director and the IMT. Internal teams, including our Operations Infrastructure Team, Operations End User Computer Team, Operations Engineering Team, Security, Risk and Compliance Team, Operational Technology Team, and Application Administrators and certain external vendors (together, the Incident Response Team Members), collectively with the IMT, form the Incident Response Team (IRT), which investigates and responds to privacy or cybersecurity incidents.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, results of operations or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, refer to Part I, Item 1A "Risk Factors."

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: No risks from cybersecurity threats have materially affected, nor has the Company identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Please see "Item 1A. Risk Factors — Risks Related to Technology and Data Security" for additional discussion of cybersecurity risks applicable to the Company.

companyName: BRAND HOUSE COLLECTIVE, INC.

ticker: TBHC


text: Company has engaged an outside contractor to assist it in developing an information security policy and include an incident response plan. The Company is in the process of developing and implementing such policies and obtaining Service Organization Control Type 2 (SOC 2) compliance certification. The SOC II certification process involves a comprehensive assessment conducted by independent auditors to evaluate our systems and controls against established industry standards. As part of the certification process, the effectiveness of the Company's information security policies and procedures to protect against unauthorized access, breaches, and data theft are assessed. The Company expects to achieve SOC 2 certification in late 2024.

companyName: CYBERLOQ TECHNOLOGIES, INC.

ticker: CLOQ


text: Although we have designed our cybersecurity program and governance procedures discussed above to mitigate cybersecurity risks, we may in the future experience cybersecurity risks, threats and attacks. To date, no risks, threats or attacks have had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact on us in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

companyName: PEDEVCO CORP

ticker: PED


text: The Company's cybersecurity team manages its incident response plan and monitoring program. Company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team is focused on evaluating emerging risks, regulations, and compliance matters and updating the policies and procedures accordingly.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: We assess the cybersecurity practices of our third-party vendors and partners to ensure they meet our security standards. Our contracts with third parties include provisions for cybersecurity requirements and incident reporting.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: Our cybersecurity risk assessment program includes a number of components, including information security program assessments, audits and maturity assessments, that are conducted periodically by both internal and external resources. Additionally, we partner with multiple third-party managed security service providers for enhanced monitoring of our information technology and data security environment and to perform proactive detection and investigation of malicious activity within our network. Our internal audit function also conducts regular assessments of different systems to provide the audit committee with information on our cybersecurity risk management processes, which processes are integrated into our overall enterprise risk management program.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Our cybersecurity risk management risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: DUKE Robotics Corp.

ticker: DUKR


text: Item 2. Properties. We do not own any material real property. Our principal executive offices are located in Chicago, Illinois. We also lease a production studio in Chicago, Illinois and administrative offices in Canada. We terminated our Naperville, Illinois office lease effective February 2024.

companyName: Cars.com Inc.

ticker: CARS


text: Managing cybersecurity threats is a component of our broader enterprise risk management program, which establishes a risk management framework that seeks to identify, assess, and monitor risks that could materially impact our business, customers, clients, employees and stakeholders.

companyName: TOYOTA MOTOR CREDIT CORP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See further discussion in Item 1A. Risk Factors.

companyName: SIMON PROPERTY GROUP L P


text: Our Information Technology Administrator, with support from third-party service providers, including our outsourced Data Protection Officer, implements and administers our information security program. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response processes. Additionally, our Information Technology Administrator, in conjunction with the Data Protection Officer, provides regular reports to our interim Chief Financial Officer and General Counsel on cybersecurity risks and the implementation of risk management processes. Such management team members report information on such cybersecurity risks and incidents to our audit committee and board of directors as discussed above.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: As with all large IT systems, we have been a target of cyberattackers and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impacts of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal control over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of this Form 10-K.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Our IT Security Team is informed about and monitors the prevention, management, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. Our managed security service provider is also tasked with testing, auditing, and monitoring the performance of our cybersecurity processes. We also maintain processes for reviewing and assessing vendor security before new engagements as part of our Vendor Advisory Board's function.

companyName: Markforged Holding Corp


text: We use third-party service providers to assist us from time to time to identify, assess and manage material risks from cybersecurity threats. In addition, we use third-party service providers to perform a variety of functions throughout our business, including, for example, hosting and processing data, manufacturing our product candidates and assisting with R&D and clinical trial activities. Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the provider, our vendor contracting processes may include imposing certain contractual provisions related to privacy and cybersecurity.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Role of the Board of Directors and Management Our CISO and Chief Technology Officer ("CTO") oversee the day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 30 years of IT experience, including over 20 years of executive level technology experience in the asset management industry. Both the CISO and CTO serve on the ISC.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Finance/Information Security Officer and our Chief Information Officer, report directly to our Chief Executive Officer, and along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: We believe our management has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, education, ongoing internal and external training and regular discussions with consultants and peers with applicable knowledge and expertise. See the following details of certain cybersecurity personnel.

companyName: FNB CORP/PA/

ticker: FNB


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with our use of these providers. The process includes risk assessments for certain vendors and reviewing security assessments and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: The Company's Office of the CISO chairs the Company's Cybersecurity Committee (the "CSC"), which oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify, detect, assess and manage risks from cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats. The CSC includes members of senior management from operations, finance and legal. The CSC is expected to meet quarterly. On behalf of the CSC, the Office of the CISO review and reports on the Company's cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.

companyName: HYSTER-YALE, INC.

ticker: HY


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as our business depends on both buyers and sellers trusting that their shopping experience with us is both reliable and safe. We have integrated cybersecurity risk management into our broader risk management framework in many ways, including (i) our regular updates to the Audit Committee, (ii) our information technology and security related internal controls and (iii) our global incident response and vulnerability management programs.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: We monitor daily reports from the firewall protection, which would indicate any suspicious activity in our accounts or system as well as notify our IT Consultant, who would contact our Chief Financial Officer. Our Chief Financial Officer would consult with our IT Consultant to assess and determine the materiality of the risk presented by the suspicious activity and to determine what steps should be taken to protect the limited data we maintain online. Depending on the materiality of the risk, our IT Consultant and Chief Executive Officer would consult with our Audit Committee of the Board of Directors to determine an appropriate notification and risk-management plan.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: leverage internal incident response plans and procedures to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Molecular Templates, Inc.


text: Our board stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. We outsource most aspects of our information technology management and these third party providers are available to address any cybersecurity issues that may arise.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: We have established comprehensive incident response and recovery plans, ensuring readiness and effective response to cybersecurity incidents.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: CIO is a member of WisdomTree, Inc.'s Governance Committee and regularly reports on cybersecurity risk management to other members of the Governance Committee comprised of WisdomTree Inc.'s senior executive officers. The Governance Committee oversees the prioritization and escalation of risks from cybersecurity threats and is responsible for strategy, operations, financial management, information technology, compliance, legal, administration and corporate governance. The members of the Governance Committee collectively possess experience in these areas, including cybersecurity and risk management.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: The Company utilizes an established internal framework designed to assess promptly the severity and materiality of cybersecurity incidents based on predefined quantitative and qualitative criteria and to determine the appropriate level of response. Incidents are escalated to the relevant management teams based on their severity and materiality for prompt response and mitigation. The Company maintains a standing crisis response team comprised of individuals from various functional units, including without limitation Information Technology, Legal, Finance, Enterprise Risk Management, Operations and Communications, to respond to cybersecurity and physical security incidents, environmental incidents and health and safety emergencies, among others.

companyName: American Water Works Company, Inc.

ticker: AWK


text: The Audit Committee receives regular presentations and reports on cybersecurity risks. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.

companyName: Nerdy Inc.

ticker: NRDY


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Manager maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Manager seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Processes to assess, identify, and manage material risks Cleco has processes and procedures in place to ensure its cybersecurity program is operating effectively. Members of Cleco's EMT routinely review its cybersecurity strategy, policy, program effectiveness, standards enforcement, and cybersecurity issue management. Cleco conducts risk assessments and compliance audits against standards including the NIST CSF, NERC CIP, and SOX. Cleco also engages with a variety of independent third parties, such as assessors, consultants, and auditors, for periodic audits and reviews of cybersecurity threats and related controls, including review of periodic penetration tests, regular patch reviews from vendors listing relevant risks, industry alerts and forums, and tabletop exercises. These assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization. Cleco also utilizes its Internal Audit department to review its cybersecurity program, in which findings are reported to the Audit Committee.

companyName: Cleco Corporate Holdings LLC


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: WORLDS INC

ticker: WDDD


text: In general, our incident and crisis management plans are aligned with the National Institute of Standards and Technology (NIST) framework for cybersecurity. These plans are intended to provide a framework and processes that allow us to take a consistent approach to cybersecurity before, during and after a cybersecurity incident. Our plans are reviewed and updated periodically. In addition, we conduct cybersecurity tabletop exercises to simulate an actual incident and increase our team's awareness and preparedness. Based upon these activities, we maintain a risk register to track identified vulnerabilities and associated mitigation plans. We also regularly conduct security awareness training and phishing exercises for our employees around the world to help them identify and report suspicious activity.

companyName: Ingredion Inc

ticker: INGR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: documented incident response process, vulnerability management policy, disaster recovery and business continuity processes, risk assessments, network security controls, access controls, physical security, asset management, tracking and disposal for certain assets, systems monitoring, employee cyber security training, penetrating testing, cybersecurity insurance, dedicated cybersecurity staff, and a security operations center.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Our board of directors, through its Audit Committee, is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: SCYNEXIS INC

ticker: SCYX


text: Our IT Infrastructure & Security Operations teams manage the day-to-day administration of our cybersecurity program. We also work with a managed security service provider to monitor for vulnerabilities and threats. The service provider has the authority to take actions to remediate critical and high vulnerabilities, and these are reported to the IT Infrastructure & Security Operations team and up to the CIO and other members of senior management, where appropriate. We engage employees in our cybersecurity efforts through a quarterly process for employees to complete mandatory security and awareness training as well as monthly simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.

companyName: REPLIGEN CORP

ticker: RGEN


text: Peabody uses digital technology to conduct its business operations and engage with its customers, vendors and partners. As the Company invests in technologies such as cloud, analytics, automation and artificial intelligence, it strives to provide the necessary controls to protect these digital assets from continuously evolving cybersecurity risks.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: As noted above, the Board has delegated oversight responsibility at the management level for risk-related matters to the Enterprise Risk Committee. The Enterprise Risk Committee has delegated primary responsibility for management-level oversight of cybersecurity risk management to the Technology Risk Committee. The Technology Risk Committee receives reports on cybersecurity risk matters on a regular basis from the company's Chief Information Security Officer.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee and the Board. The CSRC is also the body that collectively assess materiality in the event of a cybersecurity incident and meets as required to assess materiality.

companyName: Soho House & Co Inc.


text: Our Advisor has relationships with a number of third party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel, vendors and external insurance brokers.

companyName: Net Lease Office Properties

ticker: NLOP


text: The Company has a robust cybersecurity program to assess, identify and manage material risk from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including those associated with the use of third-party service providers. Our approach to cybersecurity risk management includes: • Cybersecurity awareness training, including interactive simulations and tabletop exercises for our employees, incident response personnel, senior management, and our Board; • Periodic risk assessments designed to help identify significant or potentially material cybersecurity risks to our critical systems, information, and our broader enterprise information technology (IT) environment; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • A multi-layered defense and continuous monitoring strategy employing various tools and testing, and incorporating lessons learned from our defense and monitoring efforts to help prevent future attacks; • Regular testing by our Internal Audit function of controls related to our financial information systems; and • Information security assessments conducted on third parties with whom we share sensitive electronic data against established cybersecurity frameworks;

companyName: SMITH A O CORP

ticker: AOS


text: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Report, including the risk factor entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our insulin pump product."

companyName: Modular Medical, Inc.

ticker: MODD


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessments for certain vendors and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Gamida Cell Ltd.


text: We also consult with outside experts to identify and implement best practices, help gauge the security climate, and identify effective methods for related skill development and information sharing.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: We regularly engage independent third-parties and auditors to assess our cybersecurity program and practices and assist in the mitigation of risk. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third-parties. These assessments are performed in connection with standards and requirements under the Payment Card Industry (PCI) data security standard, Sarbanes-Oxley Act (SOX), and the U.S. Department of Defense, cybersecurity capability maturity benchmarking and voluntary certifications by us, such as the Service Organization Control Type 2 (SOC 2). The results of these audits and assessments are promptly reviewed and enhancements are made to our cybersecurity program and practices based on such findings as appropriate. We also maintain a cybersecurity third party risk management program which evaluates systems and applications hosted by external parties for cybersecurity risks and assesses the security posture and features of those services. The program includes initial review, ongoing monitoring and contractual agreements with cybersecurity requirements to ensure third party services meet our standards for such providers, and the cybersecurity risks associated with the use of these services is acceptable.

companyName: Trane Technologies plc

ticker: TT


text: Our Board of Directors has delegated to the Audit Committee oversight responsibility of our risk management program, including cybersecurity, business continuity, IT operational resilience, and data privacy. The Audit Committee receives quarterly reports from our CDTO and our CISO covering cybersecurity risks, strategic programs for managing cybersecurity risk, emerging trends and operational and policy compliance metrics.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Venkatachari Dilip, the Company's Senior Executive Vice President and Chief Information and Technology Officer, has oversight of technology-related risk management issues and controls that align to the NIST CSF. Mr. Dilip previously was an Executive Vice President from September 2018 to April 2023 and has served as Chief Information and Technology Officer since joining the Company in September 2018. From May 2014 until July 2017, he served as Vice President at McKinsey Digital where he helped banks accelerate their digital transformation. From April 2009 to September 2013, he served as CEO at Compass Labs leading an innovative marketing analytics company. From March 2006 until April 2008, he served as Director of Products at Google where he led product teams for mobile ads and Google Checkout. From March 2004 until March 2006, he served as Vice President of PayPal/eBay and on the Board of PayPal Europe, where he was responsible for Payments Services, Risk and Fraud Management. Previously, Mr. Dilip co-founded and led startup companies CashEdge and CommerceSoft from 1996 until 2003.

companyName: US BANCORP \DE\

ticker: USB


text: Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT and PSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.

companyName: QUALYS, INC.

ticker: QLYS


text: We subscribe to multiple feeds and associations that discuss and monitor risks of any technology compromise at our business partners where relevant. Relevant restaurant level personnel and employees at the restaurant support center receive periodic training to bring awareness on how they can help prevent and report potential cybersecurity incidents. We also provide credit card handling training following Payment Card Industry guidelines to team members that handle guest payment information. In addition, key stakeholders involved with our cybersecurity risk management programs receive additional training and regularly participate in scenario-based training exercises to support the effective implementation of our programs. We maintain a disaster recovery plan and protect against business interruption by backing up our major systems. We routinely scan our environment for any vulnerabilities and perform penetration testing. In addition to our internal processes and controls, we engage multiple third parties to assess the effectiveness of our data security practices, including through an annual risk assessment. We conduct annual cybersecurity audits using a reputable third-party security auditor. A third-party conducts regular network security reviews, scans and audits. We require third-party vendors and service providers to complete a security questionnaire or provide a security compliance report performed by a reputable third-party to assess their risk.

companyName: BRINKER INTERNATIONAL, INC

ticker: EAT


text: Role of management Our Chief Information Security Officer, together with our Chief Product and Technology Officer and Chief Information Officer, is responsible for the day-to-day management of our cybersecurity risks. We have established a Security Council, which includes our Chief Executive Officer, Chief Commercial Officer, Chief Product and Technology Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Our employees receive regular cybersecurity training to address a broad range of key and emerging issues. In addition, we provide additional periodic training modules to address emerging threats or trends within the cybersecurity environment, perform regular simulated phishing exercises and require comprehensive cybersecurity training for all new employees.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Our Cybersecurity Program is administered by our Corporate Controller and our Chief Compliance Officer. These individuals, along with our external legal counsel and third party IT providers serve as the crisis response team in connection with any material cybersecurity incident under our Incident Response Plan. The Incident Response Plan provides guidelines for responding to a cybersecurity incident and facilitates coordination between the necessary parties. This includes notification to our senior management, and if material, reported to Board of Directors. We also utilize the services of IT and cybersecurity consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems to recommend improvements to our Cybersecurity Program. The Company maintains a cybersecurity insurance policy, which includes services of additional third party experts in the event of a cyber incident. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.

companyName: CAPITAL SOUTHWEST CORP

ticker: CSWC


text: Cybersecurity and risk management is a shared responsibility that applies to the Infinera team across all levels of the organization.

companyName: Infinera Corp


text: In 2024, the Company's Board of Directors approved the hiring of a full time Chief Information Security Officer ("CISO") reporting to the Company's Chief Information Officer ("CIO") to support a focus on information security and support the three lines of defense enterprise risk management framework. Our defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity incidents or challenges that have materially impaired our business strategy, results of operations, or financial condition. Such risks may evolve in the future to have material impact, and our cybersecurity risk management processes, including those described here, may not always operate as designed or be effective. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Operations: Problems with our internal systems, networks, or data, including actual or perceived breaches or failures by us or our partners, could cause our products to be perceived as insecure, underperforming, or unreliable, which would damage our reputation, and our financial results."

companyName: HashiCorp, Inc.


text: Training and Awareness - We provide awareness training to our employees to help identify, avoid, and mitigate cybersecurity threats. Our employees participate quarterly in required training, including privacy, phishing, and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks faced by the Company. In addition, our board of directors, as a whole and through its Audit Committee, is responsible for the oversight of cybersecurity risks. In that role, the board of directors and Audit Committee are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, the board of directors and Audit Committee receive periodic updates on the Company's Information Security Program, cybersecurity policies and practices, ongoing efforts to improve security, as well as the Company's efforts to prevent, detect, mitigate, and remediate significant cybersecurity incidents.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: We have multiple internal management committees that are responsible for the oversight of cybersecurity risk. Our Operational Risk Management Committee (ORMC), chaired by our Chief Operational Risk Officer, provides oversight and governance for our information security risk management activities, including those related to cybersecurity. This includes efforts to identify, measure, manage, monitor and report information security risks associated with our information and information systems and potential impacts to the American Express brand. The ORMC escalates risks to our Enterprise Risk Management Committee (ERMC), chaired by our Chief Risk Officer, or our Board based on the escalation criteria provided in our enterprise-wide risk appetite framework. Members of management with cybersecurity oversight responsibilities are informed about cybersecurity risks and incidents through a number of channels, including periodic and annual reports, with the annual report also provided to our Risk Committee, the ORMC and ERMC.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department and business lines, which are responsible for the design and execution of information security practices and risk mitigation.


text: For additional information on the risks we face from cybersecurity threats, refer to "Item 1A. Risk Factors - Risks Relating to Our Operation."

companyName: Enstar Group LTD


text: We have a cybersecurity risk management program for assessing, identifying, and managing material risks from cybersecurity incidents that is designed to protect the confidentiality, integrity, and availability of our information technology assets and data. Cybersecurity risk management is integrated into the overall enterprise risk management program. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition. Those processes include the development, approval and implementation of our Enterprise Information Security Policy ("EISP"), Information Security Standards, Information Security Incident Response Plan ("ISIRP") and Business Continuity Management Policy.

companyName: Federal Home Loan Bank of Indianapolis


text: We believe cybersecurity is the responsibility of every team member and provide ongoing mandatory cybersecurity awareness training globally to help team members recognize, avoid and report malicious activity. This includes interactive training to engage team members in identifying phishing risks and their appropriate response. We also provide regular training on data protection so that our team members understand the types of data they have and how to safeguard it.

companyName: Parker-Hannifin Corp

ticker: PH


text: Our Chief Product and Technology Officer oversees our information security program and leads our information security team. Our Chief Product and Technology Officer works closely with our Head of Internal Audit, in furtherance of the management of risks to the Company. The Chief Product and Technology Officer has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over fifteen years of experience leading cross-functional organizations in the development and operation of large-scale systems, primarily focused on e-commerce.

companyName: ThredUp Inc.

ticker: TDUP


text: The Board as a whole oversees our cybersecurity risk and receives reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: We regularly check and improve our security measures and educate our employees about such measures with the help of our information technology (IT) team. Key personnel are made aware of our cybersecurity process through trainings. We do not engage third party professionals or disclose our internal security measures to private parties.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Risks from Cybersecurity Threats We have not identified risks from known cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risks Related to our Self Storage Properties and our Business - We rely on information technology in our operations, and any material failure, inadequacy, interruption or security breach through cyber-attacks, cyber-intrusions, or other methods could disrupt our information technology networks and related systems and harm our business."

companyName: Global Self Storage, Inc.

ticker: SELF


text: provide regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Members of executive leadership are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to members of executive leadership, and the Audit Committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: Their CISO reports to their CIO who is responsible for the development and implementation of their and our technology, data and information management strategy. Their CIO has over twenty years of experience in technology, data management, data science and analytics. Before joining our Sponsor, their CIO previously held positions as Chief Data Officer, Global Head of Customer Intelligence, Head of Global Analytics and Head of Product Management for a large global financial services institution. Their CIO earned a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research.

companyName: JLL Income Property Trust, Inc.


text: Our cybersecurity function, led by our Head of DevSecOps and supported by our Head of IT and third-party service providers, is responsible for our cybersecurity risk management and strategy processes. Our Head of IT, who is a Certified Information Security Manager (CISM ISACA) and a Certified Information Systems Auditor (CISA ISACA), and our Head of DevSecOps, collectively have significant prior work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Cybersecurity threats are just one of the many risks that we face. While we have not experienced a cyber-security incident, there is no assurance that we will not be impacted in the future. In 2023, risks from cybersecurity threats did not materially affect and were not reasonably likely to materially affect Ampio except to the extent that our management of risks from cybersecurity threats was reflected in our overall operations strategy in 2023. Like many of the specialized or highly technical functions within our company, we believe we obtained a greater depth of support and relevant expertise from third-party IT and cybersecurity resources at an overall lower cost profile than hiring our own employees.

companyName: Ampio Pharmaceuticals, Inc.

ticker: AMPE


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board was recently tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving reports from members of senior management, including the risk manager and CEO, on areas of identified material risk to the Company.

companyName: SWK Holdings Corp

ticker: SWKH


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet the Company's security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. The Company also has procured cybersecurity insurance.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR