text: Our Board is responsible for the oversight of our cybersecurity risk management program. The Board has delegated to the Franklin Audit Committee oversight responsibility regarding cybersecurity risks. Our CSO reports directly to our Chief Risk and Transformation Officer, each of whom has extensive experience in information security and risk management. The Board and/or Audit Committee receive(s) a report on cybersecurity matters, including threats, events and program enhancements, at least annually. We update our cybersecurity policies at a minimum annually and benchmark our program to applicable cybersecurity standards and frameworks.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: We have integrated cybersecurity risk into our overall enterprise risk management (ERM) process. Pursuant to the ERM process, cybersecurity risk is evaluated for likelihood, significance, and velocity on a semiannual basis by designated risk owners. The risk owners consist of a cross-functional group of leaders, led by our CISO. Based on the ERM analysis, we adjust, if necessary, our process for the identification, assessment, and monitoring of cybersecurity threats and incidents.

companyName: LEGGETT & PLATT INC

ticker: LEG

secItem: Item 1C


text: Other members of the committee include internal or external representatives with relevant knowledge from the R&D, information technology, and legal functions as well as senior management. Our Chief Financial Officer has 25 years of experience, several of them as the responsible individual for information technology, cyber risk management, and executive head of risk management. In addition to frequent electronic communication, the committee meets periodically and as circumstances warrant to discuss and monitor prevention, detection, mitigation and remediation of risks from cybersecurity threats. On a regular basis, the Chief Financial Officer also updates the executive management team on developments within the cybersecurity sphere.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The CIO, in coordination with the Information Security Governance Committee, is responsible for leading the assessment and management of cybersecurity risks. The current CIO has over 25 years of experience in information security, including serving as our CIO since 2016, and holds a B.A. in Business with a focus in Computer Science. The CIO reports to the Board of Directors as part of the Information Security Governance Committee's updates discussed above and regularly communicates with the other members of the Information Security Governance Committee and senior management regarding cybersecurity risks.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: The cybersecurity team reports to the CISO and has responsibility to prevent, mitigate, detect, and remediate cybersecurity incidents through various processes. These processes include regular vulnerability assessments and penetration testing, security incident and event management, continuous monitoring, and threat intelligence gathering. Additionally, we employ several third parties with expertise in specific cybersecurity risk areas. These third parties report to the CISO, who actively engages with these third parties to monitor their activities and compliance with service level agreements. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the Board in accordance with our formal Cybersecurity Incident Response Plan.

companyName: Crocs, Inc.

ticker: CROX


text: We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We regularly conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. As part of our overall cybersecurity program, we engage specialized third-party vendors for certain cybersecurity functions including, but not limited to, incident response, penetration testing, and security operations center monitoring of our information technology environment. Identified risks are documented and communicated to the relevant stakeholders. Upon identification and assessment of risks, we develop and implement what we believe are appropriate measures to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures to mitigate cybersecurity risks and continuously test our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall enterprise risk assessment process.

companyName: WATSCO INC

ticker: WSO


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Our cybersecurity resilience is further strengthened through annual penetration testing performed by a leading third-party firm. This assessment includes external and internal penetration testing, Wi-Fi security evaluations, social engineering exercises and physical access testing. We leverage a vulnerability management platform to maintain comprehensive asset visibility, systematically identify risks and prioritize remediation efforts. Additionally, all corporate employees with system access must complete annual data protection and cybersecurity training to reinforce security awareness and compliance.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Trust Stamp has adopted an Information Security Incident Response Plan that establishes policy and protocol to follow in response to an information security incident or event impacting Trust Stamp. This policy applies to all Trust Stamp employees holding management responsibilities. Incidents are reported by users via various methods including verbally, email, or other methods. The Development Operations team via the Chief Technology Officer or Executive Vice President is the main point of contact for technical support issues. It is to be expected that potential security incidents will be raised through this channel.

companyName: T Stamp Inc

ticker: IDAI


text: Table of Content s Our Vice President, Information Technology and Facilities, or the VP of IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our VP of IT has worked in the information technology field for over 20 years at both biotechnology companies and management consulting firms, and holds a Bachelor of Science in Management and a Masters of Business Administration. We also maintain a team of experienced senior level engineers who design, implement and operate our information technology ecosystem, helping to implement cybersecurity best practices throughout our information technology infrastructure and governance processes. We periodically assess our processes against cybersecurity frameworks, such as the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, Center for Internet Security, or CIS, Controls, and International Organization for Standardization, or ISO, 27001.

companyName: AGIOS PHARMACEUTICALS, INC.

ticker: AGIO


text: As part of our strategy, we continue to work with industry leading vendors to conduct our internal network, cloud environment, and external pen testing, all of which are critical as we work to protect our hybrid environment. We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we have established a third-party risk management policy that requires third-party service providers to maintain security requirements and levels of services as part of their service delivery. Before engaging with any third-party service provider, we aim to conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to specific security standards and protocols.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: Our Board actively oversees our risk management activities and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks.

companyName: Rumble Inc.

ticker: RUM


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity policies, standards, processes and practices. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools that help the Company identify, escalate, investigate, resolve and recover from security incidents in a timely manner. These efforts include, but not limited to, managed detection and response, security information and event management, vulnerability management, email security filtering, threat intelligence, security awareness program, endpoint detection and response, security automation and orchestration, and intrusion detection and prevention systems.

companyName: Cano Health, Inc.


text: Risk Management and Strategy Overall Risk Management. The Company has implemented a cyber risk management program to help ensure that the Company's electronic information and information systems are protected from various threats and are built on and follow the Cybersecurity Maturity Model Certification for information security requirements and the protection of sensitive information. The cyber risk management program is maintained as part of the Company's overall governance, enterprise risk management program and compliance program. The Company's information systems experience ongoing and often sophisticated cyberattacks by a variety of sources with the apparent aim to breach the Company's cyber-defenses. The Company may face increased cyber risk due to the increased use of employee-owned devices and work from home arrangements. The Company also has cyber event related insurance. The Company is continuously reevaluating the need to upgrade and/or replace systems and network infrastructure.

companyName: Knife River Corp

ticker: KNF


text: Like many companies, we face significant and persistent cybersecurity risks. The small size of our organization and limited resources could exacerbate these risks. However, we are committed to maintaining governance and oversight of these risks and to implementing standard operating procedures ("SOPs") and training to help us assess, identify, monitor and respond to these risks. Some examples of procedures implemented include an internal inventory of software and database exposures, a risk analysis of database vendors, review of vendor back-up, security and privacy measures. In addition, we are in the process of drafting an internal cybersecurity policy which will be the basis for SOPs and training. Our internal server includes a firewall and is scanned for malware several times a day and the data is backed up in the Cloud for ease of restoration as needed. Employees are trained to avoid phishing emails and our internal controls system is designed to mitigate the risk of payments of fraudulent invoices. While we have not, as of the date of this Form 10-K, experienced cybersecurity threats, including as a result of a prior incident, that resulted in, or that we believe is reasonably likely to result in, a material adverse impact to our business strategy, results of operations or financial condition, there can be no guarantee that we will not experience a material incident in the future. Such incidents, whether successful or not, could impair our access to critical information including confidential operational and patient records and have the potential to be costly to effect remedies. See "Risk Factors" for more information on our cybersecurity risks.

companyName: Monopar Therapeutics

ticker: MNPR


text: Key maintains an Information Security Program (the "IS Program") to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key's clients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity of Key's information assets. Our Chief Information Security Officer ("CISO"), who is also the Enterprise Security Executive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key's Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.

companyName: KEYCORP /NEW/

ticker: KEY


text: Members of the Cyber Governance Committee provide quarterly updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the Company's executive leadership team about the cyber program, including information about the status of ongoing efforts to enhance cybersecurity effectiveness. The Board of Directors also receives cybersecurity awareness training.

companyName: SpringWorks Therapeutics, Inc.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology ("VP IT") or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: conducting thorough due diligence on our third-party service providers, evaluating their cybersecurity practices, and requiring contractual commitments from them to implement specific cybersecurity measures;

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Management's Governance Management's roles and responsibilities in cybersecurity oversight are clearly defined, with specific committees or positions designated for managing cybersecurity risks. The day-to-day management of cybersecurity is the responsibility of the Chief Technology Officer who oversees our technology team. These include procedures for incident response and regular reporting of cybersecurity information to the Board of Directors (the "Board"), ensuring effective communication and oversight. Cybersecurity risk management is seamlessly integrated into the Company's overall business strategy and decision-making processes, demonstrating a proactive approach to managing cybersecurity risks.


text: For a description of the risks from cybersecurity threats that may materially affect our company, see "Item 1A. Risk Factors—Risks Related to Our Business and Industry—Cyber-attacks, computer viruses, physical or electronic break-ins or other unauthorized access to our or our business partners' computer systems could result in misuse of confidential information and misappropriation of funds of our customers, subject us to liabilities, cause reputational harm and adversely impact our results of operations and financial condition.," and "—We rely on sophisticated information systems and third-party cloud infrastructure to run our business. The failure of these systems, any service disruptions or outages, or the inability to enhance our capabilities, could have a material adverse effect on our business, sales, and results of operations."

companyName: Moatable, Inc.

ticker: MTBLY


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions oversees our cybersecurity policy and strategy. Members of the ISGC, including the CIO and CPO, meet with the COO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: We recognize the importance of developing, implementing and maintaining a firm cybersecurity posture to safeguard our information systems, protect the confidentiality, integrity and availability of our data and mitigate risks associated with cyber threats and attacks.

companyName: INNODATA INC

ticker: INOD


text: Our periodic assessment and testing of policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, simulated attacks and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.

companyName: GoPro, Inc.

ticker: GPRO


text: Cybersecurity Practices We have implemented various measures to manage our risk of information technology systems and networks damage, disruption, or unauthorized access, including regular employee training, monitoring of our systems and networks, maintenance of backup and protective systems and use of modern endpoint detection and response tools, which are integrated into Aytu's risk management systems and processes. We have implemented multi-factor authentication ("MFA") across many of our systems and email accounts to prevent unauthorized access and impersonation. We also utilize a cloud-based environment for a large portion of our operations, which enhances our scalability, flexibility and resilience and utilize third parties to perform early external vulnerability assessment and risk identification. We have established extensive backup and recovery procedures to ensure the continuity of our operations in a cyber incident. We also maintain cyber liability insurance coverage as part of our comprehensive risk management program. However, these measures may not be sufficient to prevent, detect, or mitigate the impact of such damage, disruption, or unauthorized access. Moreover, the regulatory environment related to information security, data protection and privacy is increasingly demanding and complex, and compliance with applicable laws and regulations may result in significant costs or require changes in our business practices that could adversely affect our operations.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: As discussed in more detail in the "Risk Management" section of Part II, Item 7, the ERC is a cross-functional executive forum to promote awareness and dialogue on risk matters across the enterprise, including cybersecurity risks, oversee the execution of risk program requirements and sound risk management activities, and enact delegated decision-making authority and oversight routines from the BRC. Our CRO and CIO are members of the ERC. The interim CISO provides updates at every ERC meeting on cybersecurity and information security risk.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Our CIO has over 25 years of experience specializing in cloud migrations, launching innovative software products and advanced analytics as well as building high-performance development organizations. Our CISO has over 25 years of leadership experience managing global information technology, information security and IT infrastructure and operations.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: To facilitate our cybersecurity risk management program, multidisciplinary teams throughout our company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our CDO, our CISO, and the SIRT monitor the detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the CITF when appropriate.

companyName: TWILIO INC

ticker: TWLO


text: In 2022, we formalized a multi-layered security governance structure, with the goal of ensuring that responsibilities are clear, information is effectively communicated, priorities are coordinated, and proper oversight is provided. Each "layer" of the governance structure has unique meeting, reporting, and action cadences to help ensure consistent communication between our security working groups, our leadership team, and our Board of Directors.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: To date, we are not aware of any cybersecurity threats, including as a result of previous cybersecurity incidents, that are reasonably likely to have a material effect on us, our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Hess Midstream LP

ticker: HESM


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the Vice President, Information Technology, is responsible for overseeing the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Vice President, Information Technology, has over 17 years of experience, including prior industry experience consulting on various IT matters and developing and testing IT general controls and cybersecurity risk management programs. We maintain an internal staff of IT professionals who support our cybersecurity program and engage with third-party service providers to support specific areas of our cybersecurity risk mitigation and response.

companyName: Chord Energy Corp

ticker: CHRD


text: The Company maintains, and routinely reviews and evaluates its information technology ("IT") and cybersecurity policies, practices and procedures (our "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of the Company's Crisis Management Plan. Our Cybersecurity Program is administered by our IT Manager, who is managed on a day-to-day basis by our General Counsel and overseen by our IT Steering Committee consisting of our Chief Executive Officer, our Chief Operating Officer and our General Counsel. Our General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with our Chief Operating Officer and our IT Manager also included on the crisis response team. We also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems, to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. Our IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Our General Counsel has served in his oversight function as General Counsel for over 16 years and previously as our Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of our Chief Executive Officer and our Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.

companyName: Main Street Capital CORP

ticker: MAIN


text: The CISO leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups. The CISO reports to the Chief Technology and Information Officer, who has over 20 years of experience leading technology teams for multi-brand consumer businesses and leads the Company's information technology strategy and oversees the global cybersecurity function.

companyName: PVH CORP. /DE/

ticker: PVH


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack affecting us or our vendors has had a material impact on our business or results of operations. As of Feb. 27, 2025 there have been no material cybersecurity incidents to report.

companyName: XCEL ENERGY INC

ticker: XEL


text: During the year ended December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected our operations, business strategy, results of operations or financial condition. However, we expect to continue to face certain risks from ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See "Risk Factors – Disruptions to our information technology systems or our failure to adequately protect critical data, sensitive information and technology systems could materially affect our business or result in harm to our reputation."

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: Strategy and Governance The Trust has no employees or internal information systems and is managed by the Sponsor. Thus, the Trust relies on the Sponsor and VanEck, the parent company of the Sponsor, as well as the Bitcoin Custodian and Additional Bitcoin Custodian and other service providers to protect the Trust's information from cybersecurity threats. VanEck has policies, standards, and procedures on information security (the "Cybersecurity Documents"). The Cybersecurity Documents govern the procurement, use, storage, protection and permissions of data systems, applications and devices. The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: In 2023, we did not identify and were not aware of any cybersecurity breaches that we believe have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For a discussion of cybersecurity risk, please see the information contained under the heading "Cyberattacks impacting our networks or systems may have a material adverse effect on our operations" of Item 1A.

companyName: AT&T INC.

ticker: T


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications. We routinely invest to develop and implement cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, and prevention and protection capabilities. Our employees undergo annual security awareness training to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations.

companyName: Compass Group Diversified Holdings LLC


text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable target businesses.

companyName: DIGIASIA CORP.


text: Company management, including the CTO, CISO, and CIO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets for spending on cybersecurity, helping prepare for cybersecurity incidents, and approving cybersecurity processes.

companyName: PagerDuty, Inc.

ticker: PD


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position" in this annual report on Form 10-K.

companyName: MASCO CORP /DE/

ticker: MAS


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.

companyName: Sweetgreen, Inc.

ticker: SG


text: Additionally, all of the Company's employees undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year. Periodically during the year, the Company's IT department leads simulations of cybersecurity incidents with employees to test the organization's ability to respond to a variety of cybersecurity-related scenarios.

companyName: Valaris Ltd

ticker: VAL


text: Air Wisconsin's cybersecurity risk management processes include a cybersecurity incident response plan, and it has invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to its IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom Air Wisconsin may share data, and regular system reviews and security exercises. Air Wisconsin's cybersecurity risk management program is a component of its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: HARBOR DIVERSIFIED, INC.

ticker: HRBR


text: The experience of the combined QVC and Qurate Retail management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP Information Security has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: QVC INC

ticker: QVCD


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. The Company regularly assesses risks from cybersecurity threats and monitors its computer networks for vulnerabilities. To defend the Company's computer systems from cyberattacks, the Company uses various security tools that are designed to help the Company protect against, identify, monitor, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: The Company also maintains certain management committees that further assist in the prevention, detection, and mitigation of cybersecurity risks. Specifically, the CISO works closely with the Company's IT Steering Committee which, among other things, reviews the effectiveness of key controls and provides guidance around future initiatives that strengthen the Company's overall security posture. The IT Steering Committee is comprised of key executives such as the President and Chief Executive Officer and Chief Financial Officer, as well as senior employees that specialize in technology and information security, including the Company's CISO, Chief Technology Officer, and Chief Risk Officer, and a representative from the Board. This committee also monitors current events regarding cybersecurity threats to the Company and more broadly to the financial services industry to help the Company make informed decisions around any necessary internal control enhancements or adjustments. In addition to the IT Steering Committee, the IT Subcommittee assists the CISO to prevent, detect, mitigate, and remediate cybersecurity threats and incidents. The IT Subcommittee typically meets quarterly and consists of members of the information technology and information security teams, the Director of Internal Audit, and senior management members of various business units. This committee is responsible for reviewing information technology and information security projects and the threat landscape.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: Both the Company's Director of Infrastructure & Security and Vice President of Information Technology have extensive cybersecurity knowledge and skills, with each possessing over 20 years of cybersecurity and related IT security experience. The Director of Infrastructure & Security and the Vice President of Information Technology each remain informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and risks, including through their regular review of reports prepared by the Company's Information Security team and the measures implemented by the Company to identify and mitigate cybersecurity risks and related threats.

companyName: FARMER BROTHERS CO

ticker: FARM


text: The Cyber and Information Security Risk Management Program and Technology Risk Management Program are managed by the Company's Corporate Information Security team, led by the CISO and the CIO. Our CISO has over 25 years of financial services industry experience, with varying positions in information technology, security, and risk management. She has numerous industry certifications, including Certified Information Systems Security Professional and Certified in Risk and Information Systems Controls certifications. She is a member of ISACA's global Governance of Enterprise Information & Technology Advisory Group and Securing AI Certification Working Group. Our CIO has over 25 years of relevant experience in large scale digital transformation, strategic planning, talent development, global technology delivery, and operational experience. Our CIO has deep expertise across the financial services industry and in leading organizations through change. He is a member of the CNBC Technology Executive Council, where he contributes to ongoing discussions and insights on the latest trends and challenges in technology. In addition, he is a member of the Wall Street Journal CIO Network, a collective community of leading technology experts from the world's most influential companies. Both our CISO and CIO also participate in various financial services industry committees and cybersecurity advisory boards.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Company also leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program. The Chief Operating Officer manages the Company's IT and cybersecurity environment, which is reviewed at least semi-annually.

companyName: ATEL 14, LLC


text: Our Director of Cybersecurity and Networking has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of Cybersecurity and Networking has been in that position with the Company since 2019 and, including prior experience, has over 13 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.

companyName: Cactus, Inc.

ticker: WHD


text: From time to time, the Company engages third-party subject matter experts and consultants to conduct evaluations of our program and security controls, whether through penetration testing, assessments, or consulting on best practices to address new challenges. Results are used to identify and assess risks as well as drive priorities and initiatives to improve the overall Program. The Company also engages third-party experts and consultants, when deemed appropriate, to assist with responding to cybersecurity incidents, such as external legal counsel and forensic specialists.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: The Company's Processes for Assessing, Identifying, and Managing Material Cybersecurity Risks The Company's processes for assessing, identifying, and managing cybersecurity risks generally follow frameworks established by the International Organization for Standardization (ISO) and the U.S. National Institute of Standards and Technology (NIST). The Company relies on its IT infrastructure, including the GIS Program, which is designed to reduce cybersecurity risks by ensuring that computer systems are secure through protecting networks, systems, applications, hardware, and data to mitigate cyber attacks. Our business includes managing, processing, storing and transmitting proprietary and confidential data, including personally identifiable information and other confidential information. The Company's IT infrastructure and GIS Program are critical to its business activities, and any unauthorized access to, unplanned disruptions or failures of, or cybersecurity attacks, on these systems pose risks to our business, financial condition and results of operations.

companyName: BRINKS CO

ticker: BCO


text: We have designed and maintain a cybersecurity risk management program that is integrated into our overall enterprise risk management program and with other related functions, such as information technology, or IT, system architecture and vendor management; that leverages best practices and standards and that is designed to assess, identify and manage risks from cybersecurity and other information security threats. As part of this program, we periodically evaluate risks from cybersecurity threats as part of our broader risk management activities and as a component of our internal control system. In the course of our evaluation, we consider risks that may be associated both with our internally managed information technology, or IT, systems and key business functions and with sensitive data operated or managed by third-party service providers, vendors and collaborators with whom we engage.

companyName: Mersana Therapeutics, Inc.


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our management team will work to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have not been subject to cybersecurity challenges that have materially impaired our operations or financial standing. In the future, the Company will require the Board and employees to complete cybersecurity training related to the physical security of assets, data privacy and other information security policies and procedures.

companyName: WORLD HEALTH ENERGY HOLDINGS, INC.

ticker: WHEN


text: Material Effects of Cybersecurity Threats On February 3, 2025, we experienced a systems outage caused by a cybersecurity attack by threat actors who unlawfully accessed our network, encrypted critical applications, and exfiltrated certain files (herein defined as the "Cyber Incident"). Upon discovery, we promptly activated our incident response plan, engaging both internal teams and third-party cybersecurity experts.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Dow's Chief Information and Digital Officer has formal education in information technology and extensive experience working in and leading Dow's information systems and technology function. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: UNION CARBIDE CORP /NEW/


text: The CIO is responsible for the Information Security Team risk strategy, assessment, exceptions, risk acceptance, and management of the Company's material risks from cybersecurity risk appetites. Ongoing assessments cover applicable information technology and operations technology systems, applications, and software used to support Noble's corporate and rig operations. The outcome of these various assessments influences the IT risk appetite and risk identification, and acceptance is discussed and shared with the CIO in preparation for the Board of Directors meeting presentation The CIO has extensive cybersecurity knowledge and skills gained from over ten years of relevant work experience at Maersk Drilling and post-merger Noble. Prior to Maersk Drilling, the CIO served four years as CIO at Adform, a leading global advertising technology company, where he was also responsible for cybersecurity. Prior to serving as CIO of Adform, the CIO served as Chief Development Officer at Sitecore, a leading global marketing and e-commerce software and solution provider, where solution design and cybersecurity awareness was a key area of responsibility. The Information Security Team advises the CIO via cyber reports on prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Noble Corp plc

ticker: NE


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2024, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: AIR's technology team, under the leadership of AIR's Senior Vice President of Technology, who has over 30 years of technology management experience, defines an annual work plan designed to maintain strong cybersecurity maturity, set improvement objectives of key controls and systems, including feedback from third-party assessments, and identify and implement on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of our annual planning, management conducts regular tabletop testing of our incident response plan to increase awareness, establish key decision-making criteria, ensure effective communication among key stakeholders, and comply with AIR's disclosure obligations. AIR also partners with third-party experts to assess the effectiveness of our cybersecurity prevention and response systems and processes (e.g., periodic penetration testing and assessments of IT general controls). AIR also engages vendors to enhance cybersecurity safeguards and improve incident response and updates or replaces systems and applications as appropriate to improve data processing and storage management and enhance security. To further protect AIR's information systems, we structure and monitor our relationships with third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.

companyName: Apartment Income REIT Corp.


text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats.

companyName: Inotiv, Inc.

ticker: NOTV


text: Our CTO who is also a Board member, has established the CSO Office at JFrog. Our CTO and CSO have extensive experience assessing and managing cybersecurity programs and cybersecurity risks, and they work closely to define the initiatives of our cybersecurity program, the CSO organization structure and cyber business continuity plan planning. Our CTO is updated regularly on the status of our cybersecurity program. This allows us to address emerging threats and make informed decisions in real-time and to protect our systems on a timely basis. Over the past two decades, our CIO has held various positions in information technology and information security, including as CIO in two public companies, managing and controlling cybersecurity long-term programs and risks. Governance, Risks and Compliance (GRC) is managed by the CIO team, while cross-GRC activities are managed by the team, in alignment with the CSO.

companyName: JFrog Ltd

ticker: FROG


text: The Company manages strategic, operational and external risks, including cybersecurity risk, through the Enterprise Risk Management ("ERM") program which has direct involvement from the Board, the Audit Committee of the Board (the "Audit Committee"), and Senior Management. Our ERM program provides a framework whereby management conducts a comprehensive annual enterprise risk assessment to identify and prioritize the most critical risks facing the Company, as well as emerging risks, and the development and reporting of risk mitigation strategies. Through this process, we have identified cybersecurity as a risk management priority.

companyName: TAPESTRY, INC.

ticker: TPR


text: Although we constantly evaluate cyber risks, we are unaware of any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial conditions.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: While we and our service providers have experienced cybersecurity incidents in the past, as of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operation, or financial condition. For more information regarding the risks we face, please read Part I, Item 1A. "Risk Factors—General Risk Factors—Various security risks, including cybersecurity threats, data breaches, and other disruptions, could significantly affect us."

companyName: Black Stone Minerals, L.P.

ticker: BSM


text: In doing so, the CISO receives regular reports prepared by our experienced cybersecurity personnel on cybersecurity threats and continuously reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks.

companyName: Rithm Capital Corp.

ticker: RITM


text: The IT Department, led by our Director of IT, meets regularly to evaluate ongoing security threats and incidents, and continually refines policy and procedures surrounding cybersecurity risk. Identified cybersecurity threats and incidents are monitored and assessed for materiality by the Director of IT and the IT Department. This assessment includes whether our Board of Directors should be informed of a threat or incident. Cybersecurity risks are communicated and discussed with our Board of Directors at least annually.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: Security. Advanced network security measures are implemented to protect against unauthorized access and malicious activities. This includes firewalls, DDoS (Distributed Denial of Service) protection, and encryption for data in transit.

companyName: AIRWA INC.

ticker: YYAI


text: To support our cybersecurity risk management processes, we leverage a third-party information security firm ("Information Security Coordinator") who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a risk assessment conducted by a third-party cybersecurity consultant.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: The Company's information technology systems, as well as those of its third party service providers, are subject to cybersecurity threats. Significant cybersecurity threats, including intrusions into, compromises of or disruptions in the information technology systems of the Company or its third party service providers, could adversely affect the Company's financial condition and results of operations. The Company maintains and updates its information technology systems to mitigate the risk of cybersecurity threats.

companyName: PUBLIX SUPER MARKETS INC


text: We recognize the intricate and ever-changing nature of cybersecurity threats. To address this, we shall collaborate with external experts, including cybersecurity assessors, consultants, and auditors. This cooperation shall involve regular audits, threat assessments, and consultations to enhance our security measures. These efforts ensure that our cybersecurity strategies adhere to industry best practices and remain effective in safeguarding our systems.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. Our diligence and assessment extends beyond West, as the Company performs a cybersecurity assessment when third-party vendors and service providers are onboarded. Throughout the year, we monitor the effectiveness of our third-party vendors' and service providers' control environment, assessing any impact to our Company. The cybersecurity program is led by our Chief Information Officer and VP of Cybersecurity and Infrastructure Support, who provide quarterly updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the West Leadership Team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Additionally, our ERM function monitors cybersecurity risk and provides regular updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reporting to the West Leadership Team on risk mitigation and response efforts. Security controls and processes are developed and maintained to protect sensitive and confidential information while ensuring availability and integrity.

companyName: WEST PHARMACEUTICAL SERVICES INC

ticker: WST


text: Our Board of Directors has overall responsibility for the oversight of risk management, including cybersecurity risks. The Board of Directors receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments and risk mitigation activities from management.

companyName: Forward Industries, Inc.

ticker: FWDI


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting includes topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors."

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: We face risks associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- Privacy and data security concerns, laws, or other regulations could expose us to liability or impair our operations.."

companyName: ZW Data Action Technologies Inc.

ticker: CNET


text: Based on the resolution of Honda's Board of Directors, the Board of Directors has appointed the Director, Executive Vice President and Representative Executive Officer, as Honda's Risk Management Officer, who monitors and supervises the response status of significant risks, including risks from cybersecurity threats.

companyName: AMERICAN HONDA FINANCE CORP


text: Finally, management and other departments involved in our cybersecurity program participate in industry groups related to cybersecurity risk management and our IT Security Team employs third party services to gain independent perspectives of our cybersecurity program. For example, our IT Security Team belongs to various Cybersecurity Threat Advisory Committees to keep up to date on the latest threats and vulnerabilities. Technical details regarding risks and exposures associated to vulnerabilities are shared via subscription emails by these committees. In addition, we conduct annual Third-Party Posture Assessments to review the security processes and procedures that we have in place. The assessment is an unbiased review which provides credibility and trust in regards to Six Flags security posture. We also ensure our Payment Card Industry (PCI) compliance by working extensively with an external independent advisor to review and audit our systems, security measures and processes to protect cardholder data. We maintain cybersecurity insurance that we believe is appropriate for the size and complexity of our business which provides protection against the potential losses arising from a cybersecurity incident. However, there is no guarantee that our insurance coverage limits will sufficiently protect us against any future claims.

companyName: Six Flags Entertainment Corp/OLD


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: The Board of Directors holds oversight responsibility over the Company's risk management program, including material risks related to cybersecurity threats. This oversight may be executed directly by the Board of Directors or through its committees. The Board of Directors has delegated oversight of Risk Management to the Audit Committee of the Board of Directors. The Audit Committee engages in regular discussions with Management regarding the Company's risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. These discussions include evaluating current trends, internal risk assessments, and risk management policies. Annually, a comprehensive report on the state of the Information Security Program, including cybersecurity risk management, is provided to the Board of Directors by the CRO and CISO. This report includes: Risk assessment results; Third- and fourth-party vendor oversight; Results of security monitoring and testing; Security incidents or violations (if applicable); Internal and external audit results.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: We use third-party service providers to perform a variety of functions throughout our business, such as application service providers, software-as-a-service providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and other supply chain resources. We have a vendor risk management program to help manage cybersecurity risks associated with our use of these providers. This includes risk assessment for each vendor, review of security assessments, supplemental security questionnaires (as needed), security assessment calls with the vendor's security personnel, and imposition of certain information contractual obligations on the vendor. In addition, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: The Audit Committee of the Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program.

companyName: C3.ai, Inc.

ticker: AI


text: The Company also maintains a robust Vendor Risk Management program to manage risks related to third-party relationships in a manner that is consistent with the Company's strategic goals, organizational objectives, and risk appetite. This includes comprehensive risk and control assessments with respect to the appropriate safeguarding of sensitive information.

companyName: Provident Bancorp, Inc. /MD/


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Director of Information Technology, Gio Hernandez, who has over 15 years of experience in information security. Mr. Hernandez reports to our CFO, Rodney Young, who has approximately 20 years of experience supervising the information technology function.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: We maintain an incident response plan that guides us in identifying, evaluating, responding to, and recovering from cybersecurity incidents. The plan provides for the creation of a cross-functional, tailored incident response team, led by dedicated incident responders, that may include both Company personnel and third-party service providers, as appropriate. The incident response plan includes incident classification and escalation protocols, as well as processes to assess and comply with applicable legal obligations. We periodically test the effectiveness of the plan, and review and update it as appropriate.

companyName: STARBUCKS CORP

ticker: SBUX


text: Our management team, led by our CISO and Sr. Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Sr. Director of Information Security has served in various roles in information technology and information security for over 20 years and holds multiple industry-recognized certifications. Our CISO, who is also our Chief Information Officer, has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: Cybersecurity is an important component of our overall risk management program. Our cybersecurity policies and practices are integrated into our risk management program and are based on recognized frameworks. ON24 is certified under ISO 27001:2013 and 27701:2019, which sets forth a strict framework for managing security and privacy risks, including the necessary internal process and policies to deal with cybersecurity risks and incidents.

companyName: ON24 INC.

ticker: ONTF


text: The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our full Board of Directors (the "Board") oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 28 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager reports directly to the Company's Chief Technology Officer, and provides quarterly updates to the Cybersecurity Subcommittee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: There is currently no director specializing in cybersecurity. Important cybersecurity matters are reported to the board of directors, and implementations are carried out based on the Company's organizational chart, with the approval and oversight of the board of directors, CEO, and/or other executive officers, as applicable.

companyName: SBC Medical Group Holdings Inc

ticker: SBC


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Security breaches of our systems may allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information. Though we take steps to ensure our products and/or software are secure, it is possible that a cybersecurity incident could result in the loss or compromise of critical data. If a guest alleges that a cybersecurity incident causes or contributes to a loss or compromise of critical data, whether or not caused by us, we could face harm to our reputation and financial condition and regulatory repercussions. A cybersecurity incident could materially harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. See Item 1A. Risk Factors— Business, Economic, Market and Operating Risks—Failure to maintain the integrity of our internal or customer data, including defending our information systems against hacking, security breaches, computer malware, cyberattacks and similar technology exploitation risks, could have an adverse effect on our results of operations and cash flows, and/or subject us to costs, fines or lawsuits.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: To assess, identify, and manage material risks from cybersecurity threats to our information systems and the associated costs, our cybersecurity program prioritizes vulnerability management and risk reduction, detection and prevention. As part of this program, we conduct continuous monitoring for anomalous behavior using a third-party security operations center. In addition, we conduct an annual cybersecurity risk assessment in conjunction with our third-party consultant that specializes in information security, and we incorporate recommendations from the risk assessment into our cybersecurity strategy, as appropriate. This risk assessment process considers the nature of our business, requirements from our internal and external stakeholders, and industry trends and risks, including new and emerging risks. By continuously assessing the cybersecurity landscape, we develop targeted strategies that identify and address the risks most likely to impact our company. We also conduct at least one cybersecurity incident tabletop exercise each year to test and enhance our incident response plans.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our Board of Directors has delegated oversight of cybersecurity risk management to the Audit Committee. The Audit Committee reviews our major cybersecurity risk exposures and the steps that our management has taken to monitor and control such exposures. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary or appropriate, regarding any material cybersecurity incidents.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Stereotaxis, Inc.

ticker: STXS


text: We and others across our industry face a number of cybersecurity risks in connection with our business and operations. Although such risks have not materially affected our business strategy, results of operations, or financial condition to date, we have, from time to time, experienced threats to, and incidents in connection with, our information systems. Any security breach or event resulting in the unauthorized disclosure of our information or the information of our customers or the degradation of services provided by our critical business systems, whether by us directly or our third-party service providers, could adversely affect our business operations, sales, reputation with current and potential customers, associates, or vendors as well as other operational and financial impacts derived from investigations, litigation, the imposition of penalties, or other means. For more information about the information technology and cybersecurity risks we face, see the risk factors entitled "We rely on third parties for the majority of our information systems and the availability and efficient operation of such systems is critical to the operation of our business," "Cybersecurity," and "Regulatory Issues – Privacy Regulation" in discussed in Item 1A. Risk Factors.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: Absci Corp

ticker: ABSI


text: Our Chief Information Officer, Chief Privacy Officer (or in their absence, the Chief Ethics and Compliance Officer), and Vice President, Risk Management and Compliance work in collaboration as our Digital Risk Management ("DRM") group and have primary responsibility for our digital risk and security program. These individuals have extensive experience in their roles at the Company and in prior roles at other companies in the areas of information technology and security, data protection and privacy, and risk management and compliance, respectively. The members of the DRM group, among other things, continuously review and evaluate our cybersecurity risks to: identify technical and business risks; assess the potential impacts of identified risks; develop mitigation strategies to control or reduce risk where needed; communicate to others to ensure that risk owners and stakeholders as well as executive leadership have visibility into identified risks; and monitor identified risks and applicable risk response efforts.

companyName: Premier, Inc.


text: Risks from Material Cybersecurity Threats As of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective, and responsive measures.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. Our information technology (" IT ") team (In-house and outside consultants) s responsible for these ongoing monitoring and detection activities.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: White Mountains's Board of Directors has assigned oversight of the Company's cybersecurity risk management to the Audit Committee. The Audit Committee receives periodic reports on White Mountains's cybersecurity risks and any material cybersecurity incidents at the direction of White Mountains's senior management. In addition, the Audit Committee receives reports addressing cybersecurity risks as part of the Company's overall enterprise risk management program.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: To support our preparedness, we have a cybersecurity incident response plan ("CIRP") that we regularly update as business needs and the security landscapes change. In the event of a cybersecurity incident, our incident response team refers to our CIRP and existing management internal controls and disclosure processes. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform periodic tabletop exercises annually to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: The cybersecurity risk assessment process is part of the Company's overall risk management process. As noted above, the Company utilizes third-party consultants and services in our process of assessing and managing cybersecurity risk. To mitigate the risk of cybersecurity threats related to the use of third-party service providers, the Company obtains and reviews System of Organization Controls (SOC) reports from third parties when available, to provide assurance that the third-party has appropriate controls in place and has not identified any significant cyber issues. The Company does not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. See Item 1A "Risk Factors" for a summary of certain cybersecurity risks.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: Our Cybersecurity organization, which includes infrastructure security, product security, technology risk management, and security awareness and culture is led by our CISO. Our CISO, reports directly to our Chief Technology Officer ("CTO") and is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program. Our CISO has over a decade of experience leading cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations and maintains multiple industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager.

companyName: INSULET CORP

ticker: PODD


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats, as part of our Enterprise Risk Management system. In the event of a cybersecurity incident that meets established reporting thresholds, our audit committee will receive prompt and timely information regarding such incident, as well as ongoing updates until it has been addressed.

companyName: TMC the metals Co Inc.

ticker: TMC


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity team, other IT domain experts, cybersecurity managing counsel and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Corporate Secretary and Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council. In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks through updates shared during Cybersecurity Council meetings and through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our Chief Executive Officer and Chief Financial Officer are responsible for assessing and managing risks and incidents relating to cybersecurity threats. They report any material findings and recommendations, if any, to the Audit Committee and the Board of Directors.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors has delegated this cybersecurity risk management oversight function to our audit committee. Under the purview of our audit committee, our President and Chief Operating Officer, General Counsel, and Chief Financial Officer ("CFO") (collectively, the "Risk and Compliance Committee ") are primarily responsible for assessing, managing and mitigating our critical risks from cybersecurity threats. Our Head of Information Technology ("IT"), who reports directly to our CFO, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Head of IT possesses approximately 20 years of experience with information technology and cybersecurity risk management programs. Our Head of IT's responsibilities, with support from our internal IT team and external IT consultants, include assessing, monitoring, and managing our cybersecurity risks.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: Risk Management Processes Our Information Security Execution Team is responsible for the day-to-day execution of our information security strategy and operations, and comprises key stakeholders across the Company's information services & technology, engineering, legal, privacy, compliance, finance, human resources, and product teams. The Information Security Execution Team coordinates cross functionally to identify, assess, and address immediate and emerging risks from cybersecurity threats, including leading the formation and activities of working groups and response teams to address cybersecurity matters that arise from time to time. We maintain a cybersecurity incident response plan that addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies for remediation and prevention of future incidents. In carrying out our incident response plan, our Information Security Execution Team also assesses incidents, or multiple related incidents, by reference to a set of specified criteria and, if one or more of such criteria are met, reports such incidents to management.

companyName: Natera, Inc.

ticker: NTRA


text: Depending on the environment and system, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: From time to time the Breach Response Team conducts tabletop exercises to simulate responses to cybersecurity incidents, including the analysis of risks and the development of detection, mitigation and remediation strategies. The Breach Response Team also uses these exercises as an opportunity to discuss other topics related to cybersecurity, including notable developments in this area.

companyName: MOVADO GROUP INC

ticker: MOV


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, risk assessment and management policies, standards, architecture, and processes. The CISO, along with the Chief Information and Digital Officer ("CIDO"), each have over 15 years of prior work experience in various roles involving information technology, including security, compliance, and systems. The CISO provides periodic reports, which take into account information from internal stakeholders, known privacy and information security vulnerabilities, threat detection plans, and information from external sources such as reported security incidents, industry trends, and third party evaluations to our CIDO, who provides regular updates to our Audit Committee, Chief Executive Officer, and other members of our executive team. The Audit Committee receives regular updates specific to the Company's cyber security program and IT security risk, including descriptions of mitigation and incident response plans, projects to continually enhance our information security systems, overviews of awareness and training programs and the emerging threat landscape. The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO. Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As part of our cybersecurity risk management system, our governance, risk & compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers. The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: GENUINE PARTS CO

ticker: GPC


text: As an international service provider, our ISP constantly monitors information technology risk and cybersecurity threats globally. When risks are detected, we, through our Adviser and Administrator, consults with the ISP to assess if the risk is a cybersecurity threat to our information technology systems or data. If a risk to our information systems or data is identified, we then, through our Adviser and Administrator, work in conjunction with the ISP to implement recommended processes, improvements, or safeguards to our systems or processes to address the risks as needed. Relevant examples of such efforts include but are not limited to: • implementation of industry leading Cloud solutions and business applications which possess integrated cybersecurity safeguards; • anti-malware, antivirus and threat detection software; • ransomware containment and isolation software; • enhanced password requirements and multifactor authentication requirements; • endpoint encryption; • intrusion detection and response system conduct file integrity monitoring; • email archiving, firewalls, and quarantine capabilities; • mobile device management of business applications; • frequent systems backups with recovery capabilities; and • regular vulnerability scans and penetration testing.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Planet Fitness engages with a range of external experts, including cybersecurity assessors, consultants, legal advisors and auditors in evaluating and testing our risk management systems. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities and has delegated responsibility for oversight of this risk to the Audit/Compliance Committee of the Board of Directors (the "Audit Committee"). The Audit Committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our Risk Committee of the Board of Directors oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: While we, like any technology-dependent company operating in the current environment, have experienced cybersecurity incidents in the past we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations. However, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in, among other things: unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of breach-of-contract, claims and litigation by affected parties, investigations by and other proceedings involving governmental authorities and possible financial liabilities for damages, any of which could materially adversely affect our business, financial condition, reputation and relationships with customers and partners.

companyName: NLIGHT, INC.

ticker: LASR


text: Our Chief Security Officer and our Chief Information Officer report to our Security Committee, which oversees monitoring and incident response, risk mitigation, supply chain security, physical security, product security, insider trust, and other security-related items, and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Chief Security Officer and Chief Information Officer have combined relevant experience of more than 45 years, including over 20 years in cybersecurity, and they oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Security Officer monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our security team, the use of technological tools and software, and results from third-party assessments.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and our Board committees assist with certain aspects of risk oversight. With respect to cybersecurity risk, our Board of Directors shares certain of the oversight responsibility and processes with the Audit Committee of the Board of Directors ("Audit Committee").

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the "Risks Related to Information Technology." The Company has not experienced a cybersecurity threat that has materially affected the company.

companyName: CHIMERIX INC


text: Managing Material Cybersecurity Risks Within Our Overall Risk Management Framework We have strategically and deliberately integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration seeks to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management-level Security, Privacy and Compliance Committee (the "SPCC") was established to help ensure that the Company's information security strategy supports our business operations and that the Company complies with applicable laws and regulations with respect to privacy and other cybersecurity matters. The SPCC is also primarily responsible for monitoring and responding to cybersecurity threats as they arise. The SPCC meets quarterly and as necessary. The SPCC is a cross-functional committee, and its members include Company officers and associates involved in various aspects of the Company's governance and operations, including our General Counsel, Corporate Controller, Chief Information Officer, Head of Environmental, Health, Safety and Security and others, and is chaired by Mr. Richard Balducci, our Chief Information Security Officer ("CISO"). In addition, we have established a management-level Cyber Disclosure Escalation Committee (the "CDEC") to assist in the evaluation of cybersecurity incidents that may arise from time to time and the potential need for public disclosure of any such incident. The CDEC meets quarterly and on an ad hoc basis as necessary, and it reports to our CEO and other members of the Company's senior management.

companyName: Integer Holdings Corp

ticker: ITGR