text: Annually, the Audit and Risk Committee reviews and recommends for approval to the Board the Information Security Policy, which outlines the roles, responsibilities, and objectives for the Program. On a quarterly basis, the Company's Information Security Officer presents the Company's cybersecurity report and related material for review by the Audit and Risk Committee and the Board. This report includes emerging risks, overall program effectiveness/status, cybersecurity incidents, staffing, risk exceptions, and recommended enhancements to the program, as applicable. Annually, the Information Security Officer provides security related education to the Board and Audit and Risk Committee.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: The cybersecurity team has also established company-wide policies and procedures that cover cybersecurity matters, which are designed to enable us to effectively identify, evaluate, and respond to events that have the potential to impact our business. In the event of a cybersecurity incident, Brighthouse Financial utilizes a well-defined incident response plan that is designed to coordinate the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations (including relevant securities laws) and mitigate brand and reputational damage. This plan includes immediate actions to mitigate the impact of the incident, as well as long-term strategies for the remediation and prevention of future incidents. In accordance with this plan, we have established a cross-departmental Brighthouse Response Team that is responsible for coordinating enterprise-wide responses to cybersecurity incidents. This Brighthouse Response Team provides reports regarding cybersecurity incidents to the enterprise-level risk committee referenced above.

companyName: BRIGHTHOUSE LIFE INSURANCE Co

secItem: Item 1C


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, when applicable, and reports from the Chief Financial Officer on our enterprise risk profile on an annual basis. The Audit Committee reviews our information technology environment risk, which is inclusive of our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the prevention, detection, and mitigation efforts of our cybersecurity program, as well as our remediation of cybersecurity incidents, as applicable.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: a. Internal and external asset identification, assessment, monitoring and classification procedures to evaluate cybersecurity risks and inform mitigation efforts.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Vendor Management Policy, which provides a risk-based process for identifying, measuring, monitoring, and managing third-party relationships with new and existing vendors by requiring an assessment, categorization, and ranking of the risks associated with each third-party vendor and implements a third-party risk-management process that focuses on risk assessment, due diligence in selecting third-party vendors, contract structuring and review, and ongoing oversight of the operational and financial performance of the third-party vendor's products and services;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Board Oversight: SecureTech's Board of Directors actively oversees risks, including cybersecurity threats, as part of its risk management function. However, there are no dedicated processes or committees specifically informing the Board of these risks. Given our company's size and current operations, we consider the risk of significant cybersecurity incidents minimal.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: The Company's IT department is directly responsible for cybersecurity matters and routinely reports to the senior management. In the event of a cybersecurity incident, the IT department will initially report to the Company's senior management, including our Chief Executive Officer. If the incident is assessed as a material threat or incident to our information systems, our senior management will escalate the issue to the Board of Directors. Given that our core operations are in manufacturing and involve limited network-related activities, we believe that our existing cybersecurity measures are adequate.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Our ISO oversees a team of employees dedicated to the prevention, detection, mitigation, and remediation of cybersecurity incidents. He joined the Company in September, 2022 with more than 20 years of technology and information security experience in banking and as a consultant, and holds a Certified Information Security Manager certification.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: We have also established a security governance council (the "Council") to further strengthen our cybersecurity risk management activities across the Company. The Council includes our Chief Executive Officer, Executive Vice President, Chief Financial Officer and Treasurer, Executive Vice President, General Counsel, Chief Administrative Officer and Secretary, Senior Vice President, Operations, Senior Vice President and Chief Information Officer, Senior Vice President, People Services, Vice President and Chief Information Security Officer, Vice President, Chief Compliance Officer, and Associate Vice President, Internal Audit. The Council meets quarterly and is responsible for management's oversight of our IT security in a cohesive and holistic manner that is designed to enable optimal decision-making.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Vice President of Systems Engineering, and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: The Chief Financial Officer, Chief Operating Officer, Controller, and Director – Finance are all involved in communications with our IT consultants and auditors. The Chief Financial Officer notifies the Audit Committee and Chief Executive Officer of any cybersecurity threats.

companyName: Epsilon Energy Ltd.

ticker: EPSN


text: Education and Awareness We require all employees to participate in security awareness training, including frequent phishing tests. Currently, our mandatory employee training courses include Security Awareness, Physical Security Awareness, Mobile Device Security, Business Continuity and Phishing, Work From Home, and AI Chatbot. In addition, all of our employee software developers are required to take additional security awareness training, currently including Secure Development. We periodically adjust the list of mandatory and optional courses.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: Management and Board Oversight Our Board of Directors, through its Audit Committee, has primary responsibility for overseeing cybersecurity risk management and receives updates on the status of our cybersecurity program from our CISO. These updates are provided at least once per year, and often multiple times per year, in a special Audit Committee session and includes reports on our security posture and SecurityScorecard assessment (rating and benchmarking), incident response, and vulnerability management. The Audit Committee reviews and discusses with management our cybersecurity threats, vulnerabilities, defenses, and planned responses, including updates to our cybersecurity incident response plan ("IRP"), which has been approved by the Audit Committee. Additionally, the Audit Committee receives and discusses reports from management with the purpose of identifying threats and vulnerabilities, and it monitors the effectiveness and progress of the actions and initiatives undertaken to mitigate such threats.

companyName: ADT Inc.

ticker: ADT


text: We also would use similar processes, technologies, and controls to manage cybersecurity risks associated with third-party suppliers, including those who have access to our systems or our employee and other confidential data. In addition, cybersecurity considerations affect the selection and oversight of our third-party suppliers. We perform diligence on critical third-party suppliers that have access to our systems, and data or facilities that house such systems or data, and we monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require third-parties that we have identified as parties that could introduce significant cybersecurity risk to agree by contract to manage their cybersecurity risks according to standards set by us and/or to agree to be subject to cybersecurity audits conducted by our agents, which we conduct as we deem appropriate.

companyName: ETSY INC

ticker: ETSY


text: Our Board of Directors oversees our enterprise risk management process and our Audit Committee of the Board has direct oversight of our management of cybersecurity risks. Under the direction and supervision of our Chief Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks. Our Cybersecurity Steering Committee reviews the results of any enterprise risk assessment with management on a bimonthly basis and with the Board of Directors quarterly or when risks are identified. Management provides a comprehensive update to the Audit Committee of the Board on cybersecurity threats and risk mitigation at least annually, and more frequently as relevant.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide monthly cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors–Risks Related to Our Stores and Operations–We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."

companyName: Extra Space Storage Inc.

ticker: EXR


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: In addition, the Company has adopted company-wide policies and procedures and conducts periodic employee training on a range of matters with cybersecurity risk management implications, including information security and acceptable use of technology policies.

companyName: SIGMATRON INTERNATIONAL INC


text: We host, collect, process, use, and retain large amounts of sensitive and personal data across an array of our own and third-party information systems. To help protect these systems and data, we have implemented a robust information security program that includes numerous administrative, technical, and physical safeguards. We strive to evolve our cyber defenses to help minimize impacts from cyber threats. In general, we seek to address cybersecurity risks through a cross-functional approach. This approach focuses on protecting business operations and preserving the confidentiality, integrity, and availability of systems and data by preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur.

companyName: INTUIT INC.

ticker: INTU


text: In addition, our Advisor's information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for the Advisor's employees and board of directors to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our Advisor's internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.

companyName: Net Lease Office Properties

ticker: NLOP


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes as those used in our enterprise risk management. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain disruption, or other similar incidents may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A, Risk Factors, "Increased cybersecurity threats and computer crime pose a risk to our systems, networks, products and services, which expose us to potential regulatory, financial and reputational risks." for a discussion of cybersecurity risks.

companyName: nVent Electric plc

ticker: NVT


text: As a part of our organizational education on risk management, we require that employees annually complete information and privacy training. We also administer employee awareness training around phishing, malware, and other cyber risks on an ad hoc basis as necessary to enhance our protection efforts. We actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. For example, our incident response team conducts periodic tabletop exercises with outside consultants to ensure adherence to our cybersecurity incident response plan. Additionally, we maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: We have implemented a cybersecurity risk management program based on multiple cybersecurity frameworks, primarily the National Institute of Standards and Technology Cybersecurity Framework (800-171), as well as information security standards issued by international bodies. We use this program, which is integrated into our overall enterprise risk management framework, to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: SANMINA CORP

ticker: SANM


text: The Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the Board. The CISO provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. In addition, the top 10 cybersecurity risks identified as part of the ERM Program are identified to our Audit Committee on a quarterly basis.

companyName: Clear Secure, Inc.

ticker: YOU


text: We acknowledge that cyberattack risk may occur with our third-party technology service providers. High-profile cyberattacks have occurred at healthcare companies, credit bureaus, financial institutions, and other businesses for the purpose of acquiring the confidential information of individuals, including potential customers and patients. We take significant measures to prevent and mitigate issues caused by any such attacks, including outreach to our providers and other third-parties that we engage with, in order to ascertain any potential downstream implications of known breaches.

companyName: CHEMED CORP

ticker: CHE


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. For example, we have implemented and maintain an incident response plan, and we utilize automated tools designed to maintain email security. We have also implemented a computerized system security and password policy that defines security for access to computer systems managed and controlled by us, and a procedure for computerized system incident management to address any unplanned issues in regulated computerized systems that could impact subject safety, product quality, and data integrity. We periodically conduct cybersecurity incident tabletop training exercises involving our personnel and plan to conduct similar training in 2025.

companyName: GERON CORP

ticker: GERN


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser and FS Investments.

companyName: FS KKR Capital Corp

ticker: FSK


text: Management ' s Role in Cybersecurity Risk Management The Sponsor conducts annual due diligence on GLDM's service providers, including the Administrator and Custodians, which includes a revise of the relevant service provider's operational and cybersecurity controls. The Sponsor reviews and reports to the Board of Directors, the results of this annual review and any incidents or perceived risks.

companyName: World Gold Trust

ticker: GLDM


text: Refer to Item 1A. Risk Factors under the heading "We rely on the integrity and security of our information technology systems, and our business could be adversely impacted by extended disruptions, significant security breaches or other compromises of these systems" for further information on the risks we face from cybersecurity threats. We believe that to date, such risks have not materially affected and are not believed to be reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: STEELCASE INC


text: We have dedicated substantial resources to prevent and manage cybersecurity risk. We have administrative, technical, and physical security measures in place, as well as policies and procedures to require third parties to whom we transfer data to implement and maintain appropriate security measures. We proactively employ multiple methods at different layers of our systems which are designed to defend against intrusion and attack and protect our data. We also consider the threats and challenges that we and other companies face as cybersecurity attacks grow in frequency and complexity.

companyName: Dynatrace, Inc.

ticker: DT


text: CYBERSECURITY RISK MANAGEMENT Sempra, SDG&E and SoCalGas have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. These cybersecurity risk management processes include cybersecurity incident response plans that are integrated into each entity's respective enterprise risk management and emergency management programs.

companyName: SEMPRA

ticker: SREA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our network may be the target of potential cyber-attacks and other security breaches that could have significant negative consequences."

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: For many years, we have strategically invested in our cybersecurity programs across the organization, and we have developed and refined our processes for detecting, evaluating, and responding to potential cybersecurity incidents. In particular, we focus on our networks, applications, data, employees, and vendors with a comprehensive cybersecurity plan, informed by nationally recognized frameworks which we use to monitor and improve our program as compared to the framework controls. In addition to our ongoing monitoring, we engage a third-party advisor to perform cybersecurity risk assessments of our information technology security processes and implemented technologies. We have segmented our building networks so that they are separate from our corporate network, and using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across those networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we engage with our employees in a training and testing program through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery, and we also maintain a business continuity and disaster recovery plan (including a cybersecurity incident response plan) to reduce the risk and impact of business interruptions, across a range of disaster scenarios, including potential impacts from a cybersecurity incident. Our business continuity and disaster recovery plan and our cybersecurity incident response plan are reviewed at least annually, and we also periodically conduct tabletop exercises that include the CIO and key members of management.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: Management performs ongoing monitoring of the Information Security Program with a range of reports and tools that are commensurate with our risk profile. These reports and tools ensure the program continues to comply with all policies related to information technology risk and information security.

companyName: Sterling Bancorp, Inc.


text: Integration into our Risk Management Program — Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our risk management program, which includes technology as one of the five primary risk categories addressed by our risk program, with cybersecurity risks being one of the three subcategories within the technology risk category. As a result, our risk management leadership team works with the Chief Information Officer ("CIO") and Vice President of Information Technology Security ("VPIT"), which we refer to collectively as "Cybersecurity Leadership," to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our risk management program. Our risk management leadership team also meets on a quarterly basis with our cross-functional technology risk working group, comprised of leaders across the information technology, operations, internal audit, information security and legal departments, to monitor developments on an ongoing basis in the threat landscape in order to identify and prioritize key cybersecurity threats that may impact the Company.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments and reviews. As part of our risk assessment process, we may perform cybersecurity risk evaluations when selecting applicable third-party vendors, suppliers, and other service providers. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, conduct employee phishing training, and monitor emerging laws and regulations related to data protection and information security.

companyName: OOMA INC

ticker: OOMA


text: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: The Company's CISO is responsible for assessing and managing risks from cybersecurity threats. The Company's CISO also leads the Information Security group and is responsible for the day-to-day management of the Information Security Program. Katelynn Sandy is the Company's CISO and reports directly to the Company's President and Chief Technology Officer. Ms. Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology. Additionally, Ms. Sandy holds various information security certifications.

companyName: Root, Inc.

ticker: ROOT


text: The Audit Committee receives periodic reports from the ISO concerning our significant cybersecurity threats and risk, and the processes we have implemented to address them. The Audit Committee also has access to various reports, summaries of reports or presentations related to cybersecurity threats, risk and mitigation.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Our board of directors oversees the company's cybersecurity risk-management program. Management reports at least quarterly to the board on matters related to CFC's security operations, potential threats, industry-wide trends and any other related information requested by the board. The reports include information on significant cybersecurity incidents, if any, and management actions to protect CFC. We promptly notify the board of directors upon the occurrence of a significant cybersecurity incident so it may properly evaluate the incident, including management's remediation plan. In addition to the regular cybersecurity program reports, the board monitors cybersecurity risk and program effectiveness through internal audit and our enterprise risk management reporting framework. On an annual basis, members of our staff responsible for cybersecurity provide the board an overview of the company's technology strategy and planned activities to continually improve the cybersecurity program, as well as threats and cybersecurity incidents. Further, on at least an annual basis, the board of directors reviews management reports concerning the disclosure controls and procedures in place to enable CFC to make accurate and timely disclosures about any material cybersecurity incidents.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: We rely on information technology networks and systems and data processing to manage a variety of business processes and activities, including, without limitation, to process customer payments and conduct our marketing efforts. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and customer data.

companyName: Dutch Bros Inc.

ticker: BROS


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our key risks and controls relating to information systems, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives periodic reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the CIO and CISO. In addition, on at least an annual basis, the Board receives reports, summaries or presentations from our CIO and CISO related to cybersecurity threats, risk, mitigation and related processes.

companyName: CNH Industrial N.V.

ticker: CNH


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and penetration testing. Additionally, we conduct regular evaluations of our cybersecurity program, which may include internal reviews and third-party assessments to validates the program's effectiveness and resilience.

companyName: WELLTOWER INC.

ticker: WELL


text: The CSO joined altafiber in 2023 with over 20 years of cybersecurity experience in highly regulated industries and the government in identifying, managing, and mitigating cybersecurity risk. Previously, the CSO held an officer role at a large Fortune 500 financial services firm developing cybersecurity strategy and leading teams focused on risk management, security architecture and engineering, incident response, and threat intelligence. The CSO also serves on multiple advisory boards related to cybersecurity and is the current board chair for Miami University's Center for Cybersecurity.

companyName: CINCINNATI BELL INC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Vroom, Inc.

ticker: VRM


text: We repeatedly test our software during the development cycle, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our IT Manager reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks and provides an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. Any cybersecurity incidents at the Company are reported to the Audit Committee by the IT Manager.

companyName: Laser Photonics Corp

ticker: LASE


text: We maintain a data protection and cybersecurity risk management program based upon the National Institute of Standards and Technology ("NIST") Cybersecurity framework to assess, identify and manage cybersecurity risks. As part of this program, we maintain defensive network perimeter safeguards, internal mitigation and control features, continuous system and network monitoring, and contingency data protection. We also have a notification process for real-time escalation of material cyber incidents by members of our internal cybersecurity team to senior management, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and/or General Counsel, and the Board of Directors, in each case as appropriate.

companyName: BARNES GROUP INC


text: Additionally, we have established a Cyber Incident Response Plan that follows the structure of the Incident Handling Guide published by the U.S. National Institute of Standards and Technology (SP 800-61r2) and that serves as an operational guide for handling cybersecurity incidents. Our Cyber Incident Response Plan provides procedural and strategic guidance that is designed to be flexible enough to apply to a variety of different incidents, but also specific enough to provide guidelines for incident prevention, detection, analysis, escalation and notification, and containment, eradication and recovery.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: To facilitate the success of our cybersecurity risk management program, the CSIRT is composed of multidisciplinary teams throughout Redfin who are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The audit committee consists of at least three members of the Board. The ISSC includes our chief financial officer ("CFO"), our chief legal officer ("CLO"), and other key leaders across the company. Our chief technology officer ("CTO") oversees our security team. Our CFO has over 30 years of experience managing risks at Redfin, Zappos, Amazon (Home and Garden), Bain & Company and Accenture, including risks arising from cybersecurity threats. Our CLO has 16 years of experience managing risks, including risks arising from cybersecurity threats. Our CTO has over 24 years of experience, including experience managing risks arising from cybersecurity threats across several industries to include health care and business solutions. Our Director of Security has 17 years of experience building and leading cybersecurity teams at Microsoft, Ubisoft, and Citrix Systems.

companyName: Redfin Corp


text: Management, led by the director of IT, plays a critical role in assessing and managing material risks related to cybersecurity. This includes implementing day-to-day cybersecurity measures, conducting regular risk assessments, and ensuring the timely response to any cyber threats or incidents. The director of IT is responsible for ensuring that cybersecurity is integrated into our company's broader risk management strategy, with direct reporting lines to both senior executives and the board of directors.

companyName: Luvu Brands, Inc.

ticker: LUVU


text: Our ISO provides quarterly reports to our Executive Risk and Compliance Team, which is comprised of several executive officers of OFG. In addition, our Chief Risk Officer reports to the Board's Risk and Compliance Committee and, when necessary, the Board.

companyName: OFG BANCORP

ticker: OFG


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: With respect to cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner with continuous monitoring from our Security Operations Center. These tools include, but are not limited to, Endpoint Detection and Response, Security Information and Event Management, Attack Surface Management, Static Application Security Testing, Dynamic Application Security Testing, DDoS Mitigation Services, threat detections including intelligence and brand monitoring, intrusion detection sensors, network firewalls and web application firewalls.

companyName: Bandwidth Inc.

ticker: BAND


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on IT systems, data hosting and other hardware and software platforms which are hosted by EQT, the parent company of our Advisor. As such, we are reliant on EQT for assessing, identifying and managing cybersecurity risk as part of its and our overall Risk Management Framework.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Sponsor takes the issue of security seriously. Firm employees who use the technology and information resources of the firm must be aware that they can be disciplined if they violate this policy. Upon violation of this policy, an employee may be subject to discipline up to and including discharge. The specific discipline imposed will be determined by a case-by-case basis, taking into consideration the nature and severity of the violation of the cybersecurity program, prior violations of the policy committed by the individual, state and federal laws and all other relevant information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who is responsible, along with his team, for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO has served in that role since 2021 and has been in cybersecurity related roles for 25 years, including with two publicly traded companies. Our Board of Directors has delegated oversight of risks from cybersecurity threats through our information security program to our Audit Committee, which receives updates on an as needed basis from our CISO regarding risks from cybersecurity threats. Our CISO additionally provides periodic updates to our Board of Directors, our Chief Executive Officer and other senior management members, including at least twice per year through our overall Enterprise Risk Management Program. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. We maintain processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management system. Our enterprise risk register inventories significant risks to our company, including significant cybersecurity risks, and we maintain a separate functional risk register, specifically focusing on potential cybersecurity risks. Within these risk registers, we record each identified risk, describe its likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team and perform certain periodic external evaluations in addition to the assessments and network penetration tests we perform internally.

companyName: Transocean Ltd.

ticker: RIG


text: Our information security function is led by our Senior Director for Information Technology (IT) and supported by members of our legal team and a third party service provider, which helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. This team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting vulnerability assessments to identify vulnerabilities; and external threat intelligence feeds.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Oversight of Third-Party Providers Prior to doing business with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.

companyName: AGILE THERAPEUTICS INC


text: We use various tools and methodologies to assess, identify, and manage material risks from cybersecurity threats that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and use of threat intelligence feeds. The results of these activities and any key actions are reported at least once per quarter and more frequently as needed to the Audit Committee of the Board of Directors, our Chief Executive Officer, and key members of senior management. Our employees are also required to certify their understanding and completion of training for our cybersecurity policies.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: Engaged two (2) third-party service providers to monitor JAKKS systems for anomalous activity (24 hours a day, 365 days a year); Conduct disaster recovery exercise on a yearly basis;

companyName: JAKKS PACIFIC INC

ticker: JAKK


text: The Company's CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing, and managing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts. The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks. The CISO also reports cybersecurity risks and strategies directly to executive leadership. In addition, the Company has implemented an Incident Response Materiality Assessment Committee ("IRMAC"), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team ("CSIRT"). Procedures exist to ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.

companyName: CONDUENT Inc

ticker: CNDT


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors.

companyName: Co-Diagnostics, Inc.

ticker: CODX


text: The cybersecurity capabilities of third-party vendors providing system solutions to NEE or FPL or accessing NEE's or FPL's systems or data is evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.

companyName: FLORIDA POWER & LIGHT CO


text: As of the filing date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Item 1A – Risk Factors."

companyName: Forward Industries, Inc.

ticker: FWDI


text: The CISO provides quarterly updates about the Company's cybersecurity program to the BTTC. Updates may include topics such as management's efforts to identify and monitor risks, investments to improve the Company's detection and response systems, the results of risk assessments, compliance with controls, vendor oversight, strategic technology planning, and if necessary, the status of any new, ongoing, or prior cybersecurity incident. The CISO also periodically attends the BTTC meetings.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: The Company's Board of Directors plays an important role in risk oversight and discharges its duties both as a full board and through its committees. The Board has delegated oversight of risk management matters, including cybersecurity and information technology matters, to its Audit Committee. As reflected in the Audit Committee charter, the committee is responsible for reviewing information technology, cybersecurity and other data protection strategies and plans, as well as assessing incident response protocols. The Security Committee provides quarterly reports to the Audit Committee and the SVP-IT attends board meetings yearly, or more frequently as appropriate, to inform the Company's Board of Directors on cybersecurity risks.

companyName: MACERICH CO

ticker: MAC


text: We have not yet established or adopted policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. During the year ended June 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: Blue Line Holdings, Inc.

ticker: BLNH


text: program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies. The Audit Committee oversees the Company's cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access. The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company's information technology and security systems, and the steps management has undertaken to monitor and control such exposures. The Audit Committee and Board of Directors receives regular updates on the Company's cybersecurity risk management program from the Chief Financial Officer, Director of IT and third party managed service provider CISO.

companyName: Electromed, Inc.

ticker: ELMD


text: The board of directors has adopted a Cyber Security and Personal Data Breach Policy in order to reflect the importance of appropriate security, processes and procedures to the protection of data and assets, and in an effort to establish a foundation for successful protection against cyber-crime and to minimize any potential negative impacts of a successful cyber-attack. Our cybersecurity program is overseen by our Chief Technology Officer who reports directly to our Chief Executive Officer and periodically briefs the audit committee and the board of directors on our cybersecurity program and cybersecurity issues. Our Chief Technology Officer has over 25 years of professional experience in various roles across multiple industries involving leading strategic technology initiatives. Several of our directors have experience with managing and mitigating cybersecurity and technology risks, which provides our board of directors with insight into such risks and aid in overseeing our information security, operations and systems, as well as our continuing investment in and development of our cybersecurity program. The board of directors receives updates or training, as necessary, on cybersecurity issues from management, experts and legal advisors, as required. The audit committee is responsible for overseeing our enterprise risk management program, which includes consideration of technology and cybersecurity risks. The audit committee receives updates about the results of assessments conducted by outside advisors who provide independent assessments of our technology systems.

companyName: Royalty Pharma plc

ticker: RPRX


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Director, who has over 24 years of IT management experience for public companies including Synergy Pharmaceuticals, Inc.

companyName: Turnstone Biologics Corp.


text: To date, risks from cybersecurity threats or incidents have not materially affected the Corporation. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Corporation has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.

companyName: REVVITY, INC.

ticker: RVTY


text: Additionally, we maintain cybersecurity insurance which may cover some or all of the potential losses from a cybersecurity incident. During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected Intuit, including its business strategy, results of operations, or financial condition. However, we continue to face ongoing and increasing cybersecurity risks which may materially affect us in the future. Additional information on the cybersecurity risks is discussed in "Risk Factors" in Item 1A of Part I of this Annual Report, including without limitation the risk that "Security incidents, improper access to or disclosure of our data or customers' data, or other cyberattacks on our systems could harm our reputation, business, and financial condition."

companyName: INTUIT INC.

ticker: INTU


text: The Board and management believe that cybersecurity is vital to protecting proprietary and confidential information, company operations and maintaining the trust of our customers, agents, franchisees, and employees. The Company has a cybersecurity risk management strategy and a governance framework to assess, identify and manage material risks from cybersecurity threats. As discussed below, the Company utilizes both internal and external resources as part of its cybersecurity program.

companyName: Anywhere Real Estate Group LLC


text: The entire board of directors of Bancorp is actively involved in the oversight of the institution's cybersecurity risks. The Chair of the Credit and Risk Committee regularly reports the committee's activities to the board of directors. In addition, management reports to the board of directors on an as-needed basis concerning high-priority information security-related topics, such as cybersecurity incidents. This ensures that the board of directors is always informed and can provide strategic direction on significant cybersecurity matters.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: Our Cybersecurity Manager leads our cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats and reporting significant incidents to our Cybersecurity Committee, which includes our Chief Financial Officer, General Counsel and Corporate Secretary, Chief Information Officer, Cybersecurity Manager and Director of Internal Audit. Our Cybersecurity Manager has over 20 years of experience in information security and incident response and our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Additional information about cybersecurity risks we face is discussed in Item 1A, Risk Factors if this report under the heading "We are dependent upon information technology and operational technology systems, which are subject to disruption, damage, failure and risks associated with implementation, upgrade, operation and integration" which should be read in conjunction with the information above.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, and the CCO of the Advisor, manage the Company's cybersecurity program. The CCO is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The CCO has been responsible for this oversight function as CCO to the Company since inception and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Kennedy Lewis Capital Co


text: Members of the information technology organization, including the VP, Information Technology, directors and managers, maintain cybersecurity credentials, such as Certified Information Security Manager ("CISM"), Certified Information Systems Security Specialist ("CISSP"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE"), as well as technology-specific qualifications for infrastructure and security used in the IT environment.

companyName: KAMAN Corp


text: CBIZ faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations or cash flows. CBIZ has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on CBIZ's business, financial condition, results of operations or cash flows. See "Risk Factors – Risk Factors Related to Our Business and Industry – Cyberattacks or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business."

companyName: CBIZ, Inc.

ticker: CBZ


text: The Board is focused on the critical nature of managing risks associated with cybersecurity threats. The Board has delegated to its Audit Committee oversight of management's processes for identifying and mitigating risks, including cybersecurity-related risks, to help align our risk exposure with our strategic objectives.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Cyber Risk Management and Strategy Our cybersecurity risk management program is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework and The Health Information Trust Alliance (HITRUST) Common Security Framework. Additionally, we are certified as a PCI-DSS Level 1 Service Provider. The Company's cybersecurity program utilizes a cross functional, multilayered defense-in-depth approach designed to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure and required notices of cybersecurity risks and incidents when required.

companyName: Phreesia, Inc.

ticker: PHR


text: To date, we have not experienced a cybersecurity incident or data breach that has materially affected us or our business strategy, results of operations, or financial condition.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, contract research organizations, and other contractors and suppliers. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: All incidents are documented and recorded and catalogued for further review by the CISO and their team. Incidents that are deemed to be significant and/or rise to the level of a "security breach" are documented in a security incident register as part of our established vulnerability monitoring and incident response procedures.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our information technology team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly discussions with our senior officers and independent registered accounting firm.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors, and other business partners. In the last year we did not experience any material cybersecurity incidents or threats.

companyName: NEXTNAV INC.

ticker: NN


text: Cybersecurity Risk Management Processes Our approach to managing cybersecurity risks is proactive and comprehensive. We employ a range of methods to assess, identify and manage the risk of potential cybersecurity threats, including regular security audits, utilization of a third party service provider for security measures over our virtual environment, threat intelligence monitoring, and vulnerability assessments. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data. Our risk management framework is designed to mitigate potential cybersecurity risks through a blend of technological safeguards, employee training programs, and incident response protocols. We devote resources to maintain and regularly update our systems and processes that are designed to protect the security of our computer systems, software, networks and other technology assets against attempts by unauthorized parties to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and we have implemented certain review and approval procedures internally and with our banks; and have implemented system-wide changes.

companyName: INNOVATE Corp.

ticker: VATE


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: the deployment of third -party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Management and Strategy of July 31, 2025, we have implemented the following set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: Refer to the Risk Management section of MD&A for a discussion of cybersecurity risk, which is incorporated by reference into this item.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: In addition, the Company's Board of Directors, both as a whole and through its Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Company's Board of Directors and the Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both the Company's Board of Directors and the Risk Committee receive quarterly reports from the Company's management team regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We depend on our information systems and those of our third-party collaborators, service providers, contractors or consultants, which may fail or suffer cybersecurity incidents that could result in a material disruption of our development programs or loss of data and have a material adverse effect on our reputation, business, financial condition or results of operations."

companyName: Eledon Pharmaceuticals, Inc.

ticker: ELDN


text: To date, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner. See the risk factor titled "We rely on information technology and communication systems in critical areas of our operations and a disruption relating to such technology and systems, including cybersecurity threats, could harm our business." in Part I, Item 1A of this Annual Report on Form 10-K for further information.

companyName: LKQ CORP

ticker: LKQ


text: Collaborative Approach—we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The ISSC and the CSIRT work collaboratively to build and implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.

companyName: Redfin Corp


text: The Company's employees identify and assess risks from cybersecurity threats by monitoring and evaluating the cybersecurity threat environment and the Company's risk profile. The Company is not currently aware of any risks from cybersecurity threats, nor has the Company had a previous cybersecurity incident that in either case have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition.

companyName: QUOTEMEDIA INC

ticker: QMCI


text: Our CFO is informed about and facilitates prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the professionals on our cybersecurity team. In addition, we have an escalation process in place to inform our Chief Executive Officer and other members of our senior management and, if necessary, the Audit Committee and Board of Directors, of important issues or events.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: Supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security, data governance and privacy risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: For additional information regarding cybersecurity threats that may materially affect the Company, including our business strategy, results of operations, and financial condition, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: Clarus Corp

ticker: CLAR


text: Ambac and its subsidiaries are subject to various U.S. Federal and state laws and regulations with respect to privacy, data protection and cybersecurity that require financial institutions, including insurance companies and agencies, to safeguard personal and other sensitive information, and may provide for notice of their practices relating to the collection, disclosure and processing of personal information, disclosure of cybersecurity risk management practices, reporting of cybersecurity incidents, and implementation of governance practices. For example, the National Association of Insurance Commissioners ("NAIC") adopted the NAIC Insurance Data Security Model Law (#668) ("NAIC Model Law") that creates rules for insurers and other covered entities addressing data security and the investigation and notification of cybersecurity events involving unauthorized access to, or the misuse of, certain nonpublic information. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. Legislation based on the NAIC Model Law has been enacted in many states and may be enacted in other states. Certain of our subsidiaries, as insurance companies and agencies licensed in the State of New York, are also required to comply with the New York Department of Financial Services ("NYDFS") cybersecurity regulation, which establishes requirements for covered financial services institutions to implement a cybersecurity program designed to protect the confidentiality, integrity and availability of information systems of regulated entities, and information stored on those systems. The regulation imposes a governance framework for cybersecurity program, risk based minimum standards for technology systems for data protection, monitoring and testing, third-party service provider reviews, security incident response and reporting to NYDFS of certain security incidents, annual certifications of regulatory compliance to NYDFS, and other requirements. Recent amendments to the NYDFS cybersecurity regulation impose additional security requirements and new governance obligations.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: Communication to the Board occurs more frequently than quarterly, when dictated by incident and event management policies and procedures based on the criticality and urgency of the communication.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Accordingly, the Company has not incurred any expenses over the last two years relating to information security breaches. The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third-party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information and systems, or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations. There can be no assurance that the Company's third-party vendors' and service providers' cybersecurity risk management processes, including their policies, controls or procedures, will be fully implemented, complied with or effective in protecting the Company's systems and information.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Paragon 28, Inc.


text: i. Review new, expanded or modified software and applications that process, transmit, or store sensitive information to ensure appropriate information security risk management is embedded in the development and implementation processes.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: We have never had a breach of cyber-security at any point in our past. The risk to us of cybersecurity threats is in data storage of customer questions and emails. A breach of customers data could negatively materially affect our public trust and could result in loss of customers and revenue.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: We, together with our third-party vendors, employ information technology including networks, systems, and applications to support our business and decision-making across the Company, including supporting the flow of information across our business processes. Our information technology infrastructure is susceptible to cybersecurity threats. We monitor our information technology systems, including through the use of information security procedures and risk management systems, and implement initiatives aimed at improving our cybersecurity measures. Our process for assessing, identifying, managing and addressing information security risks include: • Internalization of Information Security Management. We have internalized our information security oversight by hiring a full time Head of Information Technology that has over 20 years of experience in managing information technology and guiding organizations through technology strategy, cybersecurity risk mitigation, information technology process improvement initiatives and digital transformations. He also possesses relevant experience in improving a company's cybersecurity posture and data privacy policies. He holds a Bachelor of Science degree in Information Systems and oversees all of our information security initiatives, assesses cybersecurity risks, provides cybersecurity plans, identifies opportunities for the implementation of additional cybersecurity measures and provides cybersecurity training to our employees and executives. • Third-Party Consultant. We engage a third-party information security consultant to assist in managing our risk posture. This consultant conducts periodic tests and analyses of our defensive and detective information security controls, including annual penetration tests and risk assessments as well as regular vulnerability scans and assessments. The consultant also provides live, interactive annual information security training to our employees and executive officers and monitors the effectiveness of such training through quarterly phishing campaigns. The consultant also assists us in managing cybersecurity risks associated with third-party service providers by administering a due diligence questionnaire for the Company's third-party service providers that includes a cybersecurity risk assessment and provides guidance for remediation of security gaps. • Current Plans and Procedures. The Company has implemented and maintains an incident response plan ("IRP") and a Business Continuity Plan ("BCP"). The IRP establishes the organization, actions and procedures for recognizing and responding to information security incidents; assessing incidents; notifying the appropriate individuals, regulators or organizations about any incident; organizing the Company's response activities; escalating the Company's response efforts to named executive officers and the Board of Directors based on the severity of the incident; and supporting the business recovery efforts made in the aftermath of any incident. The IRP is designed to minimize the operational and financial impacts of an information security incident and is designed to be activated when a local incident responder determines that an incident has occurred. Similarly, our BCP provides details on information security incident response and subsequent business recovery actions.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer ("CISO") on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. Additionally, quarterly advisory services and annual training are provided to the Committee from an independent firm which gives the Committee an outside perspective on the Company's cybersecurity program and keeps them abreast of cybersecurity trends affecting the industry. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer or Chief Financial Officer of any potentially significant cybersecurity incident should one occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.

companyName: PVH CORP. /DE/

ticker: PVH


text: Risk is assessed based on multiple factors. First, our IT and administrative team updates and maintains our asset inventory to ensure all assets are included in our risk management process. From there, key assets are identified, and risk is assessed based on business impact, availability of information, and attack feasibility. After the risks have been identified, they are reviewed with the stakeholders for action plans or sign-off on the acceptance of risk.

companyName: USBC, Inc.

ticker: USBC


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Adviser, Apollo, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from Apollo's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: Apollo Debt Solutions BDC


text: internal and external risk assessments designed to help identify material cybersecurity risks to our critical systems and information; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Recognizing the importance of maintaining a secure environment for our products, data and systems that effectively supports our business objectives and customer needs, Parker's full Board of Directors maintains oversight of cybersecurity. Our Board receives an in-depth report from our CDIO, at least annually, on the overall cybersecurity program, and updates throughout the year from our CDIO and CISO regarding such topics as cyber-risk management and the status of projects to strengthen cybersecurity effectiveness.

companyName: Parker-Hannifin Corp

ticker: PH


text: Cyber Security Team Our cross functional cyber security team is responsible for the overall information security strategy, risk assessment, cyber threat detection and response, and execution of an ongoing cyber program. The goal of this team is to lower the impact and likelihood of persistent threats to the extent feasible, including safeguarding of key information and the integrity of key systems. We also partner with third-party vendors to enhance our program including monitoring, pen testing, and other assessments and programs. Additionally, the Company has implemented certain information security measures which include security reviews as well as internal training and testing programs.

companyName: J.Jill, Inc.

ticker: JILL


text: We engage outside experts to evaluate and review our cybersecurity programs. These external reviews include regular audits, threat assessments, vulnerability scans, simulated attacks and other advice regarding information security practices. We regularly conduct incident response exercises with key stakeholders.

companyName: FLUOR CORP

ticker: FLR


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from COSO framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.

companyName: FGI Industries Ltd.

ticker: FGI


text: In addition, we also regularly perform phishing tests on our employees and review our training plan at least annually for appropriate updates to address results from this testing. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. On top of annual information security awareness training for our employees, we also provide focused training for certain departments. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, and incident reporting process, as well as physical security best practices.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 20 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities, our CIO, whose experience includes managing the technology professionals and processes at public and private financial services companies, beginning in December 2024, our global CIO, whose experience includes approximately 40 years of service in financial services and technology, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.

companyName: BGC Group, Inc.

ticker: BGC


text: We leverage the ISO 27001 framework for cybersecurity risk management. Our cybersecurity risk management strategy is frequently reviewed and adapted to address and meet current and emerging threats. In addition, we have taken steps to address cybersecurity threats presented by third-party service providers, to include third-party systems that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. We have formal requirements that these third parties maintain certain security controls, we assess their compliance with these requirements on an ongoing basis, and we require timely notification of potential or confirmed security breaches. We also use third-party services that help us to monitor the security risks associated with our third-party service providers. Risk treatment plans are strategically prioritized and executed, and residual risks are reported through our enterprise risk program and elevated to executive management and the Board.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Nakamoto Inc.

ticker: NAKA


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: The Chief Legal Officer and the audit committee periodically report on cybersecurity risk management to the full board of directors. The board of directors, as a whole and through its committees, has responsibility for the periodic review and oversight of information technology risks, including cybersecurity risks.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as, where it deems appropriate, any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: The cyber risk management program falls under the responsibility of our Chief Financial Officer ("CFO") and the Chief Operations Officer ("COO") who manages the overall security through routine communication and supervision of our third-party vendors. Under the guidance of our CFO, who reports to the Audit Committee, we try to minimize our data footprint to keep our cyber risk low.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: As a financial institution, cybersecurity is a high priority for us as we receive and maintain the business and personal information of our customers on a daily basis. In addition, our business operations rely extensively on the continuous operation of our information and data processing systems and related back-up systems. Accordingly, we have developed and maintain a cybersecurity program that is focused on the goals of preparing for, preventing, detecting, mitigating, responding to, and recovering from cyber threats and incidents, maintaining the privacy and protection of our customers' data, and the continuity of our information and data processing systems.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Notwithstanding the foregoing efforts, there can be no assurance that our cybersecurity risk management program will entirely eliminate all risks from cybersecurity threats or incidents. Like many other businesses, we have experienced, and expect to continually be subject to, cyber-attacks. While these past cyber-attacks have not materially affected and, in our belief, are not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect us, including by affecting our business strategy, results of operations, or financial condition. See Item 1A., "Risk Factors " for additional details regarding cybersecurity risks.

companyName: APPFOLIO INC

ticker: APPF


text: Our risk management process assesses both the probable frequency and probable magnitude of future loss based on a variety of potential risks and cyber events. The information security team also periodically engages third-party vendors to assist with our cyber threat detection and response actions, as well as to ensure our processes related to information security and defense against cybersecurity threats are appropriately designed and implemented to best prevent, detect and/or respond to a cyber threat or event.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Our Chief Information Officer and Chief Operating Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: ProPhase Labs, Inc.

ticker: PRPH