text: With respect to incident response, we have adopted an Incident Response Playbook that applies in the event of a cybersecurity threat or incident (an "IRP") to provide a standardized framework for responding to security incidents, including malware, hacking, data breach (including third-party data breach), and other types of vulnerabilities. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow. Our incident response process is generally based on the NIST Cybersecurity Framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company. Our incident response team includes our CISO and the information security team, along with various business units, as applicable, and undergoes periodic training which includes exercises on monitoring and detection tools.

companyName: MAGNITE, INC.

ticker: MGNI


text: The board of directors receives periodic reports from our Privacy and Security Officer concerning significant cybersecurity threats to us and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: NeuroPace Inc

ticker: NPCE

secItem: Item 1C


text: The board of directors' Audit Committee receives periodic reports from our Executive Director Information Technolog concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives regular reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: MACROGENICS INC

ticker: MGNX


text: Additional information security training to employees is provided through a management Information Security Steering Committee and also through targeted training overseen by the CISO. In addition, as discussed below, the Corporation has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Corporation. The Incident Response Plan is implemented and maintained by the CISO and is subject to annual review and approval by the Enterprise-Wide Risk Management Committee. Cybersecurity metrics are reported to both management level committees and the Enterprise-Wide Risk Management Committee on a quarterly basis.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Management: Third-party vendors can introduce risks. Management must ensure vendors adhere to the Company's cybersecurity standards and assess their security practices throughout the partnership.

companyName: DecisionPoint Systems, Inc.


text: We have implemented a cybersecurity risk management program that leverages the National Institute of Standards and Technology ("NIST") framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.

companyName: Journey Medical Corp

ticker: DERM


text: As of the date of this annual report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: CHEETAH NET SUPPLY CHAIN SERVICE INC.

ticker: CTNT


text: In addition, the Cybersecurity Program provides for the notification and escalation of identified cybersecurity threats and incidents, with different severity thresholds triggering notification to different recipient groups, including, as appropriate, to members of our management, the Audit Committee and to our full Board of Directors. In the event we or Angel Oak Capital, including our Manager, experiences a cybersecurity incident that materially affects, or is reasonably likely to materially affect us, members of our management and of our Manager would review the incident with the Audit Committee to consider whether and to what extent disclosure would be required under Item 1.05 of Form 8-K. An independent member of our Board of Directors has experience managing the information technology function of a mortgage acquisition, servicing, and securitization platform.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: ALLIANCE ENTERTAINMENT HOLDING CORP

ticker: AENT


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, comprised solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risks and threats and provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. Periodic updates are provided to the Audit Committee on, among other things, our cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, and the emerging threat landscape. We also engage third parties to periodically evaluate and audit aspects of our information security programs, including by conducting vulnerability assessments and penetration testing. These partnerships enable us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current. The results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: ELUTIA INC.

ticker: ELUT


text: Board and Committee Oversight. Our Board of Directors is responsible for oversight of the Company's cyber risk management program, including risk identification, mitigation strategy and efforts, and resources. The Audit Committee of the Board of Directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules. We will continue to invest in our security infrastructure to ensure it meets or exceeds industry standards for cybersecurity and employ dedicated resources to protect our systems.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO has over three decades of IT experience in life sciences organizations. Her cybersecurity work includes the development and implementation of cybersecurity policies, platforms, and robust end-user training curriculums. Our CIO and IT Information Security Group work together to monitor and report cybersecurity trends and threats to management. Additionally, we work with an external IT partner and external cybersecurity counsel to assess, identify, and manage risks from cybersecurity threats. The IT Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies, and plans on a periodic basis, and aims to review, and if appropriate update, applicable policies and procedures annually.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: We rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan; (ii) employing appropriate incident prevention and detection safeguards; (iii) maintaining a defined disaster recovery policy and employing disaster recovery software, where appropriate; (iv) educating, training and testing our user community on information security practices and identification of potential cybersecurity risks and threats; and (v) reviewing and evaluating new developments in the cyber threat landscape. Recognizing the complexity and evolving nature of cybersecurity risk, we engage with a range of external support in evaluating, monitoring and testing our cybersecurity management systems and related cyber risks.

companyName: TRANSCONTINENTAL REALTY INVESTORS INC

ticker: TCI


text: The Company's Board of Directors provide ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: GMS Inc.


text: At the management level, the Enterprise and Risk Management Committee (the "ERM Committee") discusses cybersecurity topics, including any potentially material cybersecurity incidents, as part of its oversight of the company's significant risks. Our management team, including the Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Bloom Energy Corp

ticker: BE


text: The audit committee receives quarterly updates from the IRT concerning our cybersecurity threats and risk and the processes we have implemented to address them. On an annual basis the board of directors receives a report from the IRT highlighting any significant cybersecurity threats.

companyName: Cidara Therapeutics, Inc.


text: As part of our risk management process, we engage with a range of outside providers, including cybersecurity assessors, consultants, legal advisors and auditors, to conduct periodic internal and external assessments, including, but not limited to, penetration testing. Our collaboration with these third parties also includes regular audits, threat assessments and consultation on security enhancements.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: Primary responsibility for risk management, including cybersecurity risks, lies with management. Our management team actively assesses and manages material cybersecurity risks through a structured framework. The CIO and Director of Cybersecurity lead our efforts in managing these risks:

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Incident Response Plan Oversight: Management reviews, updates and approves the Company's incident response plan. Management ensures that the plan is tested annually to determine the Company's ability to respond effectively. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.

companyName: DallasNews Corp


text: Our Head of IT, who reports to the Chief Technology Officer, a member of the executive team, has over 20 years of experience managing information technology and cybersecurity matters. The Head of IT and the Chief Technology Officer, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Key components of the risk management program include: • A risk assessment process that identifies and prioritizes material risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • A patch management system that safeguards our environment by keeping software up-to-date and resilient against threats. • Internal and external penetration testing that is conducted and reviewed either by independent third parties or qualified employees. • A third-party risk management program that is designed to ensure our vendors meet our cybersecurity requirements. • A training and awareness program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested at least annually.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: The Company engages or otherwise collaborates with cybersecurity consultants, cybersecurity experts, energy sector leaders, and other third parties in connection with the Cybersecurity Plan. Unitil Corporation also is a member of the cyber committees of both the American Gas Association and the Edison Electric Institute.

companyName: UNITIL CORP

ticker: UTL


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain policies to ensure our systems are effective and prepared for information security risks. For example, our Synaptogenix Information Security Policy, which applies to all employees, contractors and third parties granted access to our systems and provides guidelines for maintaining information security, including safeguarding personal and company-issued digital devices, learning to detect phishing and other attacks, restricting data transfer, and ensuring the judicious use of the internet and social media. We also maintain a more general Risk Management Strategy that sets forth our procedures for identifying, assessing, responding to, monitoring, and reporting risks, including any cyber-related risks.

companyName: TAO Synergies Inc.

ticker: TAOX


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our internal and our customers' data while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Management and Strategy have an information security program designed to identify, protect, detect and respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we utilize various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a reasonably timely manner. These include, but are not limited to, internal reporting and tools for monitoring and detecting cybersecurity threats. evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses.

companyName: Vestand Inc.

ticker: VSTD


text: Policy statements and regulations by state and federal bank regulators indicate that financial institutions should design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. For example, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations after a cyberattack involving destructive malware.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: While our Board oversees our overall risk management process, as part of its oversight, the Board has delegated primary responsibility for the oversight of cybersecurity risks, including management's steps to monitor and control such risks, to our Audit and Finance Committee. On a quarterly basis, our CIO and CISO provide updates to the Audit and Finance Committee on the cybersecurity and related risk management programs, including recent developments and current risk assessments. Our CIO and CISO typically also meet in person with the Audit and Finance Committee twice annually for a more detailed discussion of significant threats, risk mitigation strategies, any security program assessments and identified improvements. Additionally, our CIO and CISO meet at least annually with the full Board and report on the Company's Information Technology program and more specifically, cybersecurity matters.

companyName: HOLOGIC INC

ticker: HOLX


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other things, the CCO, the CTO, the chief financial officers of CIM companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM. The Subcommittee is tasked with assisting CIM-managed companies that are subject to the SEC's cybersecurity rule adopted in 2023, including us, in complying with such cybersecurity rule.

companyName: CIM Opportunity Zone Fund, L.P.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our client's and our data. We have a global cybersecurity and privacy program to help effectively assess, identify, and manage cybersecurity threat risks. We have developed a list of cybersecurity risks from known threats and our own history to help identify what is most meaningful and potentially impactful to the Company. The cybersecurity and privacy initiatives to address the risks are complex, strategic, and ever evolving. Threats and risks are identified from threat intelligence sources that include our vendors, industry, and government organizations. We continuously monitor and scan the cyber landscape to review evolving threats and risks that may impact us. Information from these various sources are reviewed by our cybersecurity and risk teams to evaluate risks in line with the NIST Cybersecurity Framework. Threat intelligence from other financial institutions and industry consortiums that serve financial institutions, such as the Financial Services Information Sharing and Analysis Center, provides key information on how risks are affecting our industry, with ability to preemptively mitigate emerging threats, as discussed above in Part I, Item 1A of this Form 10-K under the heading Technology and Data Security.

companyName: CRAWFORD & CO

ticker: CRD-A


text: The Cybersecurity Program is informed, in part, by the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to, and recover from cybersecurity incidents. Controls are embedded within our processes and technology, and system activities are measured and monitored by our cybersecurity and information security subject matter specialists and applicable security operations centers at our different business units. We utilize an enterprise-wide "defense-in-depth" risk management strategy to effectively integrate people, processes, and technology.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The Board receives regular updates from the CISO, CTSO, and CAO regarding matters related to technology and cybersecurity. The Company has protocols, as discussed below, by which certain cybersecurity concerns, incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Dollars in millions except per share amounts with numerous agencies in the U.S. government to help protect U.S. communications networks and critical infrastructure, which, in turn, informs our cybersecurity threat intelligence.

companyName: AT&T INC.

ticker: T


text: As part of our cybersecurity program, we regularly test our cyber defenses by performing simulations and drills at a technical level with third-party experts, internal user susceptibility testing and reviewing our operational policies and procedures. Our cyber security team monitors alerts and meets to discuss threat levels, risk ranking, trends and remediation. Further, we conduct regular external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. We conduct security assessments on additions and changes to our systems and applications including third-party service providers. In addition, our Audit Services group conducts periodic reviews of cyber security controls, procedures, and applications and monitors remediation activities. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Fossil Group, Inc.

ticker: FOSL


text: We believe that information security is a critical component of our business strategy. Therefore, we maintain and continuously assess and strengthen our cyber security program. Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business.

companyName: CXJ GROUP CO., Ltd

ticker: ECXJ


text: Like others in the insurance industry, AFG experiences cyber-attacks and other attempts to gain unauthorized access to its systems on a regular basis and anticipates continuing to be subject to such attempts. Over the last three years, AFG has not experienced any material adverse events and has not paid any penalties or settlements related to an information security breach.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition. For additional information concerning risks related to cybersecurity, see Item 1.A. Risk Factors: "Our business and operations would suffer, and could be negatively affected, in the event of system failures or cyberattack s. "

companyName: PDS Biotechnology Corp

ticker: PDSB


text: Our incident response process is designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with our incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to our Board of Directors for certain cybersecurity incidents.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: To maintain high security standards, we leverage third-party tools and services that adhere to industry best practices, including multi-layer authentication. Despite our efforts, we acknowledge that cybersecurity threats are constantly evolving, and we remain vigilant in our efforts to protect our information systems and data.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: We depend on integrated information systems to conduct our business. Accordingly, we have processes in place designed to protect our information systems and to assess, identify and manage material risks from cybersecurity threats. As part of our Cyber Security Continuous Improvement Strategy, we continuously assess and improve our information systems to keep pace with the evolving threat landscape. We maintain a cybersecurity program that incorporates security measures from frameworks like the National Institute of Standards and Technology and the Center for Internet Security ("NIST"). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Alongside the Company's preventative measures that employ traditional and artificial intelligence technologies, we actively monitor and audit our information technology and data assets to detect any anomalies and to respond quickly to potential threats that may arise. In addition to applying security controls to prevent unauthorized access to sensitive information and protecting the Company's information systems and networks from exploitation by outsiders, we also deploy cybersecurity training courses to all employees annually, maintain an incident response plan, establish cybersecurity contingency plans and conduct phishing testing on a quarterly basis.

companyName: TRIMAS CORP

ticker: TRS


text: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services. These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls. Further, we deploy technical safeguards that we believe are designed to help protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers. The program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the IT/Cybersecurity Committee of our board of directors. Furthermore, our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed. Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out internally and by our third-party service providers.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: Before engaging third-party service providers who may have access to the Company's, customer, employee or other sensitive data, or to the Company's systems, we perform due diligence in order to identify and evaluate their cyber risks, which includes self-attestation questionnaires (developed using Service Organization Controls (SOC) reports). This process is led by the Vendor Management team and includes participation of dedicated information security resources. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. After contract executions, third party service providers deemed critical by our vendor management office undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: In addition, we engage independent third-party cybersecurity providers for testing and vulnerability detection. We regularly engage with these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and provide security awareness trainings and supplemental trainings as needed.

companyName: Mama's Creations, Inc.

ticker: MAMA


text: The Cyber Incident Response Team ("CIRT") is notified of all cybersecurity incidents, and is responsible for detecting and coordinating responses to security incidents. This team regularly assesses its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss response options. The CIRT also addresses each incident, unless it determines that an incident is sufficiently serious. In those instances, it will notify the Cyber Security Watch Team, which is responsible for addressing cybersecurity incidents that raise more significant risks.

companyName: Level 3 Parent, LLC


text: Our General Counsel oversees and manages our cybersecurity program. Our General Counsel acts as the coordinator of our cybersecurity team, which includes representatives from our Information Technology department and Compliance department. In addition, he regularly interacts with various department heads from both our New York and Florida regions regarding the prevention, detection, mitigation and remediation of cybersecurity risks. Our General Counsel has an educational background in computer science and has relevant work experience in cybersecurity insurance and risk management, in addition to his relevant legal experience.

companyName: FONAR CORP

ticker: FONR


text: Our Vice President, Global Head of Information Technology and Chief Information Security Officer and our Security Steering Committee (which includes our Chief Financial Officer, Chief Product Officer, Senior Vice President of Engineering and General Counsel), identify, assess and manage the Company's cybersecurity threats and risks (the "Cybersecurity Function"). Various individuals that are part of the Cybersecurity Function help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: manual tools, internal and/or external audits, automated tools, conducting threat assessments for internal and external threats, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, use of external intelligence feeds, evaluating our and our industry's risk profile, third-party-conducted red/blue team testing and tabletop incident response exercises, and evaluating threats reported to us.

companyName: CS Disco, Inc.

ticker: LAW


text: The Company faces a range of cybersecurity threats including threats common to many industries, such as ransomware and denial of service, as well as more advanced threats specific to critical infrastructure industries such as mining. CONSOL Energy's customers, equipment suppliers, transportation facility providers and joint venture partners face similar cybersecurity threats, and a cybersecurity incident affecting the Company or any of these entities could materially affect our operations, performance and results of operations. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity, please see the section titled "Risk Factors - Terrorist attacks or cyber incidents could result in information theft, data corruption, operational disruption and/or financial loss."

companyName: Core Natural Resources, Inc.

ticker: CNR


text: The head of Oaktree's cybersecurity team has substantial information technology and cybersecurity experience, with a career spanning over 30 years in managing global IT operations in a wide range of areas, including cybersecurity, IT governance, controls, compliance, data center operations, network engineering and cloud computing.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Quantum-Si Inc

ticker: QSI


text: We do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Risks Relating to Our Intellectual Property and Information Technology" under Part I, Item 1A "Risk Factors" above.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: This governance structure ensures that cybersecurity risks are effectively managed by the IT Department, with oversight from the IT Officers and the Board. It maintains clear lines of communication and accountability, enabling timely decision-making and response to cybersecurity matters.

companyName: RiskOn International, Inc.


text: Significant threats are reviewed by the Cybersecurity Group to determine whether further escalation is appropriate. Any cybersecurity threat or incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to designated members of our executive management team; namely our Chief Financial Officer, Chief Operating Officer and General Counsel, who, in addition to the Director of IT Infrastructure, are responsible for overseeing and managing material risks from cybersecurity threats. Further, the Company provides an annual cybersecurity assessment to ArcLight.

companyName: TransMontaigne Partners LLC


text: We are no t aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Group, including our business strategy, results of operations, or financial condition.

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: The Company continues to face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, or reputation. Although such risks have not materially affected us, we have experienced threats to and breaches of our data, including breaches caused by human error or breaches affecting third parties of the Company. For more information about the cybersecurity risks we face, see Item 1A-RISK FACTORS.

companyName: Beacon Financial Corp

ticker: BBT


text: The Core Team is informed of cyber incidents from diverse sources, including for example, internal monitoring systems, information sharing organizations, employees, and other external information sources. Depending upon the levels of access to our information and/or information systems, third party service providers are contractually obligated to report cybersecurity incidents within their environments. The Core Team performs incident analysis and triage to determine scope, severity, prioritization and required response plans to address an incident in a manner that is intended to minimize the impact to us, our assets, and our operations. In accordance with applicable legal and regulatory requirements, this analysis and triage step includes an assessment of the potential for material impact to us from a cybersecurity incident or a series of individually immaterial related incidents that are material when aggregated.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties' information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally seek to contractually require such third parties to manage their cybersecurity risks in certain proscribed manners. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Engagement of Third Parties The Company uses an IT Managed Service Provider in conjunction with a Cybersecurity Advisory firm to perform various functions, guiding the Company's cybersecurity posture, and providing ongoing support to the Company's cybersecurity program. The Company has Incident Response retainer services that can be leveraged, when needed.

companyName: Drilling Tools International Corp

ticker: DTI


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company.

companyName: Mural Oncology plc


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We may require third-party service providers and consultants with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: IntelGenx Technologies Corp.


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from cybersecurity experts; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: Our IRP sets out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: We believe that all employees of the company have a duty to manage cybersecurity. We have implemented industry standard guidelines that help ensure that cybersecurity governance is a priority. Our BOD is also very involved in the cybersecurity governance. We conduct regular searches for threats and suspicious activities, and we monitor passwords and change passwords within industry expectations. Due to the technical aspects, we have a lot of individuals that are very capable and are able to quickly act if we are to find any issues with our cybersecurity.

companyName: Universal Token

ticker: UTKN


text: Board of Directors - Oversight and Management Reporting The Audit Committee of the Board of Directors (the "Audit Committee") is primarily responsible for overseeing cybersecurity risks, and the Board of Directors is actively engaged with respect to these risks. The Audit Committee and/or the Board of Directors generally meet with our CTO and CISO on a quarterly basis to review our information technology and cybersecurity risk profile and to discuss our activities to manage the related risks, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends, tabletop exercises, and other areas of importance. In addition to these regular meetings, we have an escalation process in place to timely inform the Board of Directors of any significant cybersecurity incidents, including any updates relating thereto, to ensure that the Board of Directors' oversight is proactive and responsive. Our Chief Compliance Officer also regularly reports to the Audit Committee regarding the Company's compliance with applicable regulations relating to cybersecurity.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Roles and Responsibilities Peoples' Board of Directors provides oversight of risks from cybersecurity threats primarily through the Risk Committee of the Board. The Risk Committee is comprised of all of the independent directors of the Board, along with Peoples' Chief Executive Officer ("CEO"), and is responsible for oversight of Peoples' risk management policies, programs and processes. The Risk Committee is organized and conducts its business pursuant to a written charter adopted by the Board. At least annually, the Risk Committee reviews and reassesses the adequacy of its charter and recommends any proposed changes to the full Board as necessary to reflect changes in regulatory requirements, authoritative guidance and evolving practices. On at least a quarterly basis, Peoples' Chief Risk Officer provides a report to the Risk Committee regarding the overall risk condition of Peoples and whether it is within Peoples' stated risk appetite.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: While cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, future incidents may interrupt our operations and could materially adversely affect our business, results of operations and financial condition.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: We take our responsibility for the privacy and security of the information our customers share with us seriously. Through our cybersecurity program, we constantly watch for threats to our systems and make real-time adjustments to our defenses to protect customer data and minimize service disruptions.

companyName: Unum Group

ticker: UNM


text: Prudential's information security program is overseen by its Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"), Stacey Goodman. Each of Prudential, the Manager, their affiliates and the Company believes that Prudential's employees and the employees of the Manager, Subadviser and their affiliates who provide services to the Company, respectively, responsible for managing cybersecurity risk have the skills and knowledge to assess and manage material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. Prudential expects these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. Prudential's CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. Prudential's CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. Ms. Goodman, our CIO, was elected Executive Vice President and Chief Information Officer of Prudential and PICA in July 2019. Previously, she served as the Chief Information Officer at Freddie Mac, where she was responsible for the technology division, and served as a member of the Senior Operating Committee. Prior to Freddie Mac, Ms. Goodman was Executive Vice President and Chief Information and Operations Officer for CIT Group, Inc., where she was a member of the Executive Management Committee. Previously, Ms. Goodman was the Divisional Chief Information Officer of Global Technology and Operations at Bank of America. She also held global leadership positions at UBS and PaineWebber. Ms. Goodman began her career at Salomon Brothers.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: The Company's President and Chief Information Officer, who has a Certified Chief Information Security Officer certification and over a decade of experience leading information and cyber security oversight, is responsible for developing and implementing our information security program, overseeing our IT team and reporting on cybersecurity matters to the Audit Committee. We view cybersecurity as a shared responsibility, and we consult with third-party resources and advisors as needed on information security maturity assessments, penetration testing, dark web reviews, best practices to address new challenges, and, when applicable, digital forensics. All employees are required to complete annual information security trainings and have access to more frequent online information security trainings.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: Our board of directors is actively involved in overseeing risks from cybersecurity threats. At least once a year, the board of directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Additionally, our board has delegated to our Audit Committee the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies. Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.

companyName: VOLITIONRX LTD

ticker: VNRX


text: We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct tabletop exercises to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: We designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: The Alcoa Board of Directors (Board), in coordination with the Audit Committee, is responsible for the oversight of our cybersecurity risk management program. The Audit Committee and the Board receive regular updates regarding the state of the Company's cybersecurity program, cybersecurity developments, and emerging threats. The Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) regularly update the Audit Committee and the Board regarding the Company's strategy to mitigate cybersecurity risks, which includes regular vulnerability assessments and employee training on cybersecurity matters. Alcoa's CISO is responsible for maintaining identified material cybersecurity risks within the Company's ERM platform. On a quarterly basis, the CISO reviews and updates risks, as well as the control procedures in place. These risks are regularly reported to the Audit Committee and Board.

companyName: Alcoa Corp

ticker: AA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of homebuyers and borrowers and information about our employees, contractors, vendors, and suppliers. Our Financial Services business relies heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. As such, we have established information security practices leveraging the National Institute of Standards of Technology (NIST) Cybersecurity Framework to measure our security posture, deliver risk management, and provide effective security controls to protect the privacy and confidentiality of our information. Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. Our program further includes review and assessment by external, independent third parties, who assess and report on our defense posture and internal incident response preparedness and help identify areas for continued focus and improvement.

companyName: Century Communities, Inc.

ticker: CCS


text: Our European and Latin American businesses also maintain cybersecurity programs, which are led by experienced officers as outlined in the Company's 2023 Annual Report on Form 10-K.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team composed of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Our cybersecurity risk management framework is focused on the following key areas: • Regular cybersecurity risk assessments; • Design and implementation of controls to mitigate any identified cybersecurity risks; • Continuous evaluation of the effectiveness of such controls; and • Implementation of an incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: OFG BANCORP

ticker: OFG


text: Cybersecurity Strategy, Policy and Procedures We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined within Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We utilize information technology ("IT") that enables our teams to access both operational and financial performance data in real time, while at the same time, identifying and preventing cybersecurity threats and risks.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: As part of our risk management process, we conduct application security assessments, security audits, third-party penetration testing, vulnerability assessments and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. Associates of the Company complete an annual cybersecurity training program in which specific threats and scenarios are highlighted based on the cyber risk management team's analysis of current cyber risks to the Company or as required by regulatory frameworks. Simulated phishing tests are conducted with associates on a regular basis to provide training and awareness against scams and fraudulent communications. Associates also receive ongoing communications regarding the importance of guarding against phishing, social engineering and other cyberattack vectors. In addition to our in-house cybersecurity capabilities, at times, we also engage consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risks. We maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: In addition, we have an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across our businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and promote the efficient and effective management of our enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to our Global Executive Committee and the audit committee of our board of directors, as appropriate.

companyName: StepStone Group Inc.

ticker: STEP


text: Board of Directors is informed of relevant cybersecurity risks and related updates during Board meetings by the CFO. There have been no critical, time sensitive cybersecurity updates thus far, but if this did occur it would be escalated to the Board immediately.

companyName: Vertical Data Inc.

ticker: VDTA


text: Our information security program is designed and managed to be consistent with the framework and guidelines of the FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook and FFIEC Cybersecurity Assessment Tool. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur. Along with periodically being examined by our regulators, the Company regularly engages external experts to audit, evaluate and validate our controls against these standard frameworks, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these examinations, audits and evaluations.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Management is responsible for the day-to-day risk management process, including the identification of risks and implementation of policies and procedures designed to manage, mitigate or monitor cyber risks. In support of these responsibilities, management has designated a Chief Compliance Officer and formed a Compliance Committee to implement, manage and oversee a corporate compliance program.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: The Audit Committee is responsible for, and actively engaged in, the oversight of our IT and cybersecurity program, including the oversight of risks from cybersecurity threats. Two of the members of the Audit Committee have obtained a certification or completed coursework in cybersecurity. The Audit Committee, at least quarterly, receives reports from the Company's Senior Director – Information Technology ("SDIT") on, among other things, the Company's cybersecurity incidents, risks, threats and measures, training and organizational readiness. The board of directors is kept apprised of cybersecurity risk matters, including through participation in the quarterly cybersecurity briefings to the Audit Committee that are described above. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the board of directors and Audit Committee.

companyName: Valaris Ltd

ticker: VAL


text: Our Board, through the Risk Committee, is actively engaged in the oversight of our information security program. The Risk Committee oversees our information security program, including management's actions to identify and evaluate, material cyber vulnerabilities, threats, and risks as well as the development and implementation of mitigating and remediating actions. Our Chief Information Security Officer presents quarterly reports to the Risk Committee regarding our information security program, including relevant information on key risk and performance indicators related to cybersecurity matters as well as significant cybersecurity and privacy events. In addition, our information security risk profile is presented to the Risk Committee on a semi-annual basis.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Our cybersecurity team consists of in-house cybersecurity professionals and external threat analysts, consultants and service providers. Our in-house professionals and external threat analysts possess various cybersecurity certifications, including Security +, Network +, A + and Server + certifications.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: Our head of Information Technology ("IT") oversees overall cybersecurity management and implements our cybersecurity programs with the IT group, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic reports to our Audit Committee at least semi-annually. The head of IT holds a Masters in Computer Information Systems and a Bachelor of Science degree in Microbiology, and has served in leadership roles within the pharmaceutical and biotechnology industries for over 25 years, including leading enterprise-wide cybersecurity strategies, regulatory compliance programs, and IT transformation initiatives at leading biopharmaceutical companies. The head of IT has expertise spanning cybersecurity governance, risk management, cloud security, AI-driven cybersecurity enhancements, infrastructure modernization, and enterprise-wide IT resilience. The head of IT plays a key role in aligning cybersecurity frameworks with industry regulations such as SOC compliance, SOX, GxP, and data privacy standards, ensuring a secure and compliant IT environment to support business objectives.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: The technology team leader oversees our internal team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents. Our IT professionals routinely report on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our technology team leader and chief operating officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.

companyName: LeonaBio, Inc.

ticker: LONA


text: As further discussed in our risk factors in Item IA of this report, our cybersecurity policies and controls may not be implemented or followed appropriately to mitigate all of our risks. We employ three lines of defense designed to address this risk. The first line of defense consists of the technology teams who develop, build, and deploy our products and services. These teams are trained on and accountable for following our Key Controls. The second line of defense includes separate internal security and risk teams that conduct security assessments of our networks and products, overseeing the remediation of any findings. Finally, our independent internal audit function operates as the third line of defense, assessing the effectiveness of our policies and controls and implementation thereof. We are also subject to regular, detailed examinations by financial regulators and external auditors which often contain a significant cybersecurity component.

companyName: VISA INC.

ticker: V


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: The Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: We deploy several processes for assessing, identifying and managing material risks from cybersecurity threats. These processes include, but are not limited to, security assessments, physical access restrictions, internal and external penetration testing, endpoint detection and response, and employee security awareness programs and training.

companyName: Fathom Digital Manufacturing Corp


text: Governance. Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.

companyName: Immix Biopharma, Inc.

ticker: IMMX


text: Management is responsible for the day-to-day administration of the Company's risk exposures and has adopted a risk management framework including identification, analysis and response to risks affecting our business. The Company has established a committee of senior leaders which is chaired by the Company's Executive Director of Information Technology.

companyName: VALUE LINE INC

ticker: VALU


text: Our global chief information security officer (CISO), under the direction of our chief digital officer, leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks. Our CISO regularly updates the Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, in addition to updates on enterprise cybersecurity incidents and key Company defenses and mitigation strategies.

companyName: RTX Corp

ticker: RTX


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations (CROs), and contract manufacturing organizations (CMOs). We have processes to manage cybersecurity risks associated with our use of certain of these providers. These processes include reviewing certain vendors' written security program and security assessments, and imposing certain contractual obligations related to cybersecurity on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see the sections titled "Risk Factors—Risks Related to our Business and Operations—If our telecommunications or information technology systems, or those used by our collaborators, CROs, CMOs, clinical sites, third-party logistics providers, distributors, or other contractors, consultants, or third party service providers upon which we rely, are or were compromised, become unavailable, or suffer security breaches, loss, or leakage of data or other disruptions, we could suffer adverse consequences resulting from such compromise, including but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related our business, and other adverse consequences." and "Risk Factors—Risks Related to Government Regulations—Actual or perceived failures to comply with applicable data protection, privacy and security laws, regulations, standards, and other requirements could adversely affect our business, results of operations, and financial condition."

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; awareness and spear-phishing resistance training of our employees, and senior management; cybersecurity incident response plan that includes procedures for responding to cybersecurity vendor management policy for service providers.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: AMAZON COM INC

ticker: AMZN


text: We periodically assess and test our cybersecurity procedures. We identify and assess material risks from cybersecurity threats by engaging outside advisors and experts to identify, anticipate, and assess future threats and trends, to perform assessments on our cybersecurity risk and measures to mitigate such risk, including information security maturity assessments of our information security control environment. The results of such assessments and reviews are reported as appropriate to the Cybersecurity Committee and Audit Committee, and we adjust our cybersecurity procedures as necessary based on the information provided by these assessments and reviews.


text: The Receiver currently oversees the Partnership's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Highline's cybersecurity specialist briefs the Chief Executive Officer, who presents to the Receiver as necessary on the effectiveness of the Partnership's cyber risk management program and any potential cybersecurity threats.

companyName: GPB Holdings II, LP


text: Many of our information technology systems and networks are cloud-based or managed by third parties, whose future performance and reliability we cannot control. The risk of a cyberattack or security breach on a third party carries the same risks to us as those associated with our internal systems. We seek to reduce these risks by performing significant vendor due diligence procedures prior to engaging with any third-party vendor who will have access to sensitive data. Additionally, we require annual audits of certain third parties' information technology processes.

companyName: BGSF, INC.

ticker: BGSF


text: To date, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For additional information about our cybersecurity risks, see "Any disruption in our software and related information technology systems due to a cyber incident could adversely affect our business, operating results and financial condition" under the heading "Risk Factors Relating To Our Business" in Item 1A. of this Annual Report.

companyName: TABLE TRAC INC

ticker: TBTC


text: The Company (or third parties on which it relies) may not be able to fully, continuously and effectively implement security measures and controls as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security measures and controls to implement, and it is possible that the Company may not implement appropriate security measures and controls if management does not recognize, or underestimates, a particular risk. In addition, security measures and controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Cybersecurity threats and incidents, even when detected or foreseeable, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: We engage third-party service providers in connection with our cybersecurity risk program, including assessors, consultants, and auditors. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, we include security and privacy addendums to our contracts where applicable.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives quarterly reports from our CIO and/or our FVPIS regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The CIO and FVPIS report quarterly to the Audit Committee and Board regarding cybersecurity risks and the status of our cyber risk management program. Our CIO and/or FVPIS also periodically make presentations to Board members on cybersecurity topics as part of the Board's continuing education on topics that impact our company.

companyName: PRICESMART INC

ticker: PSMT


text: Urban One employs continuous threat monitoring, security awareness initiatives, and incident response protocols to mitigate these risks. Our security team remains focused on maintaining a proactive and adaptive security strategy to minimize the likelihood and impact of cybersecurity incidents.

companyName: URBAN ONE, INC.

ticker: UONE


text: Our CTO provides our Board of Directors with quarterly reports on cybersecurity risks and any material cybersecurity incidents. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity program and other cybersecurity developments. Regular reporting mechanisms to our Board of Directors and senior management keep all stakeholders informed about the evolving cyber risk landscape and the program's effectiveness.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: Our incident response team is responsible for identifying potential cybersecurity incidents and communicating information regarding the nature and severity of the incident to senior management and others as required by the Company's written Incident Response Plan. Cybersecurity incidents are tracked pursuant to our incident monitoring processes defined within the Incident Response Plan. Potential cybersecurity incidents may also be reported to our Disclosure Committee to determine if further action and/or public disclosure is required. We have also put in place a vulnerability management program through which our systems are routinely scanned to help identify vulnerabilities and track remediation activities.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks. In 2024, FirstEnergy also evaluated its current third-party vendors to identify which vendors had similar access to personally identifiable information and is currently reviewing the results of its analysis.

companyName: FIRSTENERGY CORP

ticker: FE


text: 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, data security, regular maintenance and patching and access controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: 3. Management's Role in Cybersecurity Management plays an active role in implementing cybersecurity policies, conducting risk evaluations, and ensuring compliance with regulatory requirements. The IT security team collaborates with third-party cybersecurity vendors, including Rapid7, Cisco, and Carbon Black, to enhance the Company's security posture.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our Chief Information Security Officer is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervising such efforts. The cybersecurity team collectively has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as information obtained from governmental, public, and private sources, including external consultants engaged by the Company on a real time basis. The Company is continuously enhancing its processes for oversight of third-party vendors, including appropriate due diligence for new providers and continuous monitoring, including ongoing direct contact with vendor personnel. Third-party vendors are re-evaluated at regular intervals as part of our supplier qualification process.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The Security Awareness Campaign is designed with the goal that employees are educated on policy, threats, and best practices from onboarding and throughout their tenure at the Company. This effort includes an onboarding training program, annual attestation and training, and weekly communication designed to help instill in employees a security mindset through repetition.

companyName: Investar Holding Corp

ticker: ISTR


text: The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company's enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Our board of directors has overall oversight responsibility for our risk management, and delegates its oversight of risk assessment and management guidelines to the audit committee of the board of directors. Members of the audit committee receive periodic updates from our CFO, who is briefed by our Senior Director of Information Technology, regarding matters of cybersecurity. These discussions may include updates on management's efforts to address and mitigate cybersecurity risks, cybersecurity incidents (if any), and the status of key information security initiatives. Executive management will promptly update our board of directors regarding significant threats and incidents as they arise.

companyName: MBX Biosciences, Inc.

ticker: MBX


text: As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: Lakeside Holding Ltd

ticker: LSH


text: While we have dedicated significant resources to identifying, assessing, and managing material risks from cybersecurity threats, our efforts may not be adequate, may fail to accurately assess the severity of an incident, may not be sufficient to prevent or limit harm, or may fail to sufficiently remediate an incident in a timely fashion, any of which could harm our business, reputation, results of operations and financial condition. For an additional discussion of certain risks associated with cybersecurity see Item 1A, "Risk Factors" above.

companyName: XPO, Inc.

ticker: XPO


text: These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. Our Information Security Team is comprised of our Chief Financial Officer, Ambassador—Director of Marketing, Accounting Manager, and Accounting Support.

companyName: Gaucho Group Holdings, Inc.


text: The Software Director, Platform Tech Manager, and dedicated admin for Green Light Guru report directly to Kamran Shamaei, the CTO.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Management is not aware of any previous cybersecurity incidents of any significance. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could be successful. Although CPS is generally down the supply chain from prime contractors, the fact that we do work in the aerospace and defense industries does make us a potential target. Please refer to the risk factors titled " Manufacturing interruptions or delays could affect our ability to meet customer demand and lead to higher costs " and " If we are subject to cyber-attacks, we could incur substantial costs and, if such attacks are successful, we could incur significant liabilities, reputational harm, and disruption to our operations " in "Risk Factors" in Part I, Item 1A of this Form 10 -K for more information on the risks posed to us by cybersecurity threats. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.

companyName: CPS TECHNOLOGIES CORP/DE/

ticker: CPSH


text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with and receives cybersecurity information or reports from members of the Company's Risk Management Committee, the Company's Chief Information Security Officer ("CISO") and other members of management.

companyName: LKQ CORP

ticker: LKQ


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Executive Officer, who has founded and led several biotech companies for over 20 years, all of which have implemented systems and processes to protect sensitive clinical data and patient information. He is supported by our IT consultant, Compass MSP, a leading provider of technology managed services. Our consultant conducts a vulnerability assessment annually and tests our backup and recovery systems frequently.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Risk Identification The CISO will identify reasonably foreseeable risks to the security or integrity of each Information System. The risk identification process will consider appropriate internal and external threat scenarios based on people, process or technology vulnerabilities that could cause the Information System to be compromised, damaged, tampered with or otherwise impaired.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Information Technology Manager and Chief Operating Officer, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, incidents are reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: Nutex Health Inc.

ticker: NUTX


text: Additionally, EastGroup has information technology general controls in place in support of internal control over financial reporting. These controls are tested by the Company's internal audit function and control deficiencies, if any, would be reported to senior management and the Audit Committee of the Board of Directors.

companyName: EASTGROUP PROPERTIES INC

ticker: EGP


text: We structure our information security program around Federal Financial Institutions Examinations Council ("FFIEC") and Federal Deposit Insurance Corporation ("FDIC") regulatory guidance, along with other applicable industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to evaluate program effectiveness. Our Chief Technology and Innovation Officer ("CTIO"), along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.

companyName: Kearny Financial Corp.

ticker: KRNY


text: We have developed a cyber incident response plan which provides a documented framework for handling security incidents and facilitates coordination across multiple parts of the company. Dedicated members of our information security team, led by our Vice President, Infrastructure, constantly monitor threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we periodically perform simulations and drills at both a technical and management level.

companyName: Summit Materials, LLC


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including the business strategy, results of operations or financial condition, and management does not believe that such risks are reasonably likely to have such an effect over the long term.

companyName: VALVOLINE INC

ticker: VVV


text: Management's Role in Assessing and Managing Cybersecurity Threats — Our information technology team is responsible for assessing, identifying and managing cybersecurity risks. Top cybersecurity risks are also integrated into our overall ERM framework and overseen at the management level by the ERM Steering Committee. Our Director of Information Technology, who reports directly to the Chief Financial Officer ("CFO") and Senior Vice President and is a member of the ERM Steering Committee, is responsible for our efforts to comply with applicable cybersecurity standards, establish cybersecurity protocols and protect the integrity, confidentiality and availability of our information technology infrastructure. Technology and cybersecurity policy decisions are made by our Director of Information Technology in consultation with our CFO and Senior Vice President. In addition, our Director of Information Technology has a direct line of communication with our President and CEO and Executive Vice President and General Counsel as needed. Our Director of Information Technology has over 20 years of experience in cybersecurity, holds a Master of Science in Cybersecurity from the University of Houston and is a Certified Information Systems Security Professional and a Boardroom Certified Qualified Technology Expert.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Our cybersecurity risk management team - including our Executive Vice President, Chief Financial Officer and Treasurer, Executive Vice President, Chief Administrative Officer, Executive Vice President, General Counsel and Secretary, Senior Vice President, Chief Accounting Officer and Controller, Senior Vice President, Information Technology, and the Vice President, Enterprise Applications - is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel, our retained external cybersecurity consultants, and the simulated tabletop exercises of our Cybersecurity Incident Response Plan, conducted at least annually to ensure our team is prepared to respond to any future cybersecurity incidents. The team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel, publicly available information about cybersecurity risks and threats, and through alerts from security tools deployed in our IT environment.

companyName: KILROY REALTY CORP

ticker: KRC


text: Management, including the CISO, provides comprehensive briefings to the Board on cybersecurity risks at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the Board is regularly briefed on updates related to the Company's Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the Board and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks and updates on any significant developments in the cybersecurity domain.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: Our cybersecurity program is overseen by the Information Security Committee (ISC), a cross-functional management committee whose membership include the CISO, Chief Risk Officer (CRO), Chief Technology Officer, Chief Compliance Officer, and others. Members of the ISC possess substantial experience in risk management, finance, and information security. The ISC is responsible for ensuring that the cybersecurity strategy and program align with our overall risk strategy. Our TPRM program is overseen by the Corporate Operational Risk Committee (CORC), a cross-functional management team whose membership includes leaders from our third-party risk management, corporate services, compliance, sourcing, information technology, and business resiliency teams. The CORC is responsible for ensuring risks to our non-insurance operational functions, including those related to third-party vendors, are identified and managed within our risk appetite, and that our TPRM program and strategy align with our overall business objectives.

companyName: Unum Group

ticker: UNM


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for the oversight of risks from cybersecurity threats.

companyName: GRI Bio, Inc.

ticker: GRI


text: In recognition of the evolving cybersecurity threat landscape, we acknowledge the increasing sophistication and frequency of cybersecurity incidents, including unauthorized access to critical health information and other personal data. Although we cannot completely protect against the possibility of a cybersecurity incident occurring, we take proactive measures designed to help prevent and mitigate risks from cybersecurity threats, including measures implemented by our third-party managed services provider. We are dedicated to investing in our cybersecurity infrastructure in an effort to safeguard our data confidentiality, integrity, and availability, and uphold the trust of our stakeholders.

companyName: BRAINSTORM CELL THERAPEUTICS INC.

ticker: BCLI


text: Tom Curtis. Mr. Curtis was appointed President, Burger King U.S. & Canada in October 2021. From May 2021 to October 2021, he was the Chief Operating Officer, where he was responsible for overseeing field operations, restaurant development and restaurant operations. Prior to joining BKC, Mr. Curtis spent 35-years at Domino's Pizza, Inc., where he most recently served as Executive Vice President, U.S. Operations and Global Operations Support, overseeing both franchise and company-owned operations from March 2020 to April 2021. Prior to that, he served as Executive Vice President, Corporate Operations from July 2018 to March 2020, and as Vice President of Franchise Relations and Operations Innovation from March 2017 to July 2018. Mr. Curtis joined Domino's in 2006, after being a Domino's franchisee since 1987.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our incident response plan provides a concise strategy of how we will respond to an incident, including who will respond and their roles and responsibilities, the facilities that are in place to help with the management of the incident, how decisions will be taken with regard to our response to an incident, how communication will be handled both internally and externally, and defining what will happen once the incident is resolved and how we can learn and improve from the situation.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Inception Growth Acquisition Ltd

ticker: IGTA