text: Risk management is further managed through the use of an expert third party company to assist in managing relevant risks. We outsource our monitoring to a third-party provider whereby we benefit from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to us promptly by our third-party provider and material and potentially material incidents would be assessed by management for remediation and future prevention and detection. business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: Notwithstanding the effort we place on cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats or incidents which have materially affected or are likely to materially affect our Company, results of operations, or financial condition.

companyName: MAYS J W INC

ticker: MAYS

secItem: Item 1C


text: threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: SurgePays, Inc.

ticker: SURG


text: The Board of Directors plays a crucial role in overseeing the Company's management of cybersecurity risks. The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management. Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Transformation Officer, Chief Information Officer, internal information security team, and third-party experts. These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and the Company's response to significant incidents.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: We have adopted an Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our DOIS has nearly a decade of experience within cybersecurity functions and his skillset includes security architecture and engineering, incident response and penetration testing. Our CIO joined the Company in 2023 and most recently served as CIO and VP at another large organization where he built a high-performing, global, collaborative IT team to focus on digitization, M&A, analytics and cybersecurity and has held other vital IT positions over the course of his career.

companyName: Westrock Coffee Co

ticker: WEST


text: We regularly conduct internal and external audits, reviews, assessments, and evaluations to evaluate our compliance posture and the effectiveness of our physical, technical, and organizational measures for protecting us and our systems. Elements of our cybersecurity program are also periodically audited as part of external certification audits. Third-party managed security providers and cybersecurity experts provide us with 24x7 monitoring, threat hunting, risk assessments, penetration testing, and attack surface management to support our Cyber Security Framework. Key findings from cybersecurity audits and third-party risk assessments are summarized and communicated to our senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program. We contractually require our vendors to comply with cybersecurity and data privacy requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.

companyName: Concentrix Corp

ticker: CNXC


text: The Risk Committee is responsible for overseeing our Framework, including cybersecurity and technology risk. The Risk Committee regularly receives reports from management on our cybersecurity and technology risk profile, and key enterprise cybersecurity initiatives, and on any identified significant threats or incidents, or new risk developments, which, in the aggregate, are intended to present an overall view on the status of our cybersecurity program and the Company's compliance with applicable legal and regulatory requirements. The Risk Committee coordinates with the full Board of Directors regarding the strategic implications of cybersecurity and technology risks.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: On a daily basis, we maintain an efficient communication channel between our customer service department and IT department, through which any anomaly issues are promptly reported and responded to. Any severe anomaly will receive immediate attention. During national holidays, designated personnel from IT department will be responsible to monitor. In the event of the occurrence of any serious anomaly, we will refer to the Guideline for protocols and workflow.

companyName: SCIENTIFIC ENERGY, INC

ticker: SCGY


text: We assessed all third-party vendors, including our third-party IT firm, before engaging them for various services.. We have partnered with a third-party IT firm for cybersecurity services, with the Managed Security Operations Center operating 24/7/365 for automated email monitoring, malicious email quarantine, and reporting. The Head of IT will be notified and proceed accordingly if an event or incident requires input.

companyName: Bit Digital, Inc

ticker: BTBT


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As we are fully externally managed, we are reliant on our external advisor's network and risk management program.

companyName: LUB LIQUIDATING TRUST


text: Our multi-level cybersecurity governance and risk management structure begins with our management-level Enterprise Risk Management ("ERM") Committee, which consists of cross-functional management representatives throughout Progress. The ERM Committee receives detailed cybersecurity information from key security personnel, led by our Chief Information Security Officer ("CISO"), and reports to Progress' Chief Executive Officer, Chief Financial Officer, Chief Information Officer, Chief Legal Officer, and other members of CEO Staff at least quarterly.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.

companyName: Versus Systems Inc.

ticker: VS


text: We are building on our current program towards a more comprehensive cybersecurity risk management program. Our roadmap for the future is centered on the maturation of our cybersecurity risk management program to align to international IT frameworks, such as NIST and ISO 27001 that will strengthen our defenses, enhance our threat detection capabilities, and ensure the confidentiality, integrity, and availability of our critical systems and data.

companyName: AIRGAIN INC

ticker: AIRG


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Risks Related to Our Business and Structure— We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."

companyName: Onex Direct Lending BDC Fund


text: We have an annual assessment performed by a third-party specialist of the cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a Risk Mitigation Plan to mitigate such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Banzai International, Inc.

ticker: BNZI


text: In addition, our CIO closely monitors the cybersecurity team's approach with regular reviews of security risks and vulnerabilities, security strategy and the implementation of mitigation plans and technology, and reports quarterly to our Audit Committee and Board of Directors on, among other things, threats, mitigation measures, and preventative procedures and software.

companyName: GLOBAL INDUSTRIAL Co

ticker: GIC


text: Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cybersecurity attacks, including those tied to global conflicts, pose a potentially significant risk to the security of our information technology systems, networks and services, as well as the confidentiality, availability and integrity of our data and the confidential data of our employees, customers, suppliers, and other third parties that we may hold. Although, to date, we have not experienced a material cybersecurity incident resulting in a significant interruption of our operations, the scope of any future incident cannot be predicted with any meaningful accuracy. See "Item 1A. Risk Factors" for more information.

companyName: Bunge Global SA

ticker: BG


text: Mattel is subject to cybersecurity threats that could have a material adverse impact on its results of operations, financial condition, and liquidity, as further discussed in Item 1A "Risk Factors" under the headings of Legal and Regulatory. Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition. However, there can be no assurance that Mattel will be able to mitigate negative impacts in the same way in the event of future attacks or other cyber incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: We are a blank check company with no business operations. Since the IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. We depend on the digital technologies of third parties, and any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Aimei Health Technology Co., Ltd.

ticker: AFJK


text: The Audit Committee receives reports from management on the Company's cybersecurity risks and the Company's cybersecurity program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents. The Audit Committee regularly updates the Board on such matters,and the Board also periodically receives presentations from management directly on our cybersecurity risk management.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Engaging Third Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we have engaged a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating, testing, and improving our risk management systems. These partnerships enable us to leverage specialized knowledge and insights and includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our company recognizes the critical importance of cybersecurity in our digital operations and has established a risk management program to address both internal and external cybersecurity threats. Despite our comprehensive efforts and critical resource allocation, we acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks. We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.

companyName: ATIF Holdings Ltd

ticker: ZBAI


text: The Cybersecurity Committee receives reports and updates at committee meetings from our Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), and other executives and cybersecurity specialists. Following each committee meeting, the chair of the Cybersecurity Committee briefs the full board of directors on matters covered at the prior Cybersecurity Committee meeting. The board also receives periodic briefings on emerging trends in order to enhance its literacy on cybersecurity issues. At least annually, the Cybersecurity Committee receives updates about the results of the Cybersecurity Program reviews. The Cybersecurity Committee participates with management periodically in "tabletop" exercises to evaluate our data breach incident response plan.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor's Degree in Computer Engineering and Master's Degree in Computer Science, our CISO holds a Bachelor's Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Our CISO, executive management team, Service Center Board, and ITCC evaluate the type and severity of the incident, review applicable legal and regulatory requirements for disclosing cybersecurity incidents, and determine whether, when, and to whom the incident must be reported.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Security Operations Center (SOC) and Managed Detection and Response (MDR) services to ensure continuous monitoring and response to potential threats.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Director of IT and General Counsel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.

companyName: Origin Materials, Inc.

ticker: ORGN


text: Depending on the nature of the services provided, and the sensitivity and quantity of information processed, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments have no t experienced any material cybersecurity incidents in the past, and we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in the cybersecurity of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. We carry insurance in amounts that we believe are reasonable for our business that provides protection against potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may arise from a cybersecurity incident.

companyName: Streamex Corp.

ticker: STEX


text: Our management team, including, but not limited to, our Senior Vice President of Technology, Director of Information Systems Security, and Director of Information Systems Governance Risk and Compliance, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience spans over 20 years in all aspects of information technology including cybersecurity, IT operations (infrastructure engineering and architecture design), and IT governance audit compliance across industries such as energy, healthcare, pharmaceuticals, and finance.

companyName: P3 Health Partners Inc.

ticker: PIII


text: Our IT Department addresses current and emerging cybersecurity matters. This function is led by our Vice President of Information Technology Services, who reports to our Chief Financial Officer, and brings more than 15 years of leadership experience in enterprise technology, digital transformation, and operational risk management. This position oversees the Company's information technology, cybersecurity, data governance, and enterprise architecture functions and has led multi-year modernization initiatives across infrastructure, core business platforms, and security tooling. The Vice President of Information Technology Services has experience managing cybersecurity frameworks, vulnerability management programs, OT/IT security integration, vendor risk oversight, and incident response preparedness, in addition to a background in leading cross-functional teams, partnering with external security firms, and strengthening organizational controls to reduce cyber, operational, and compliance risks. The Vice President of Information Technology Services holds both a masters degree and a bachelors degree in business administration. Prior to working at Compass Minerals, the Vice President of Information Technology Services held various positions of increasing responsibility within the IT function, including Business Solutions Architect; Manager, Business Solutions; and Director, Business Solutions. The IT Department's security team, led by our Senior Manager, Cybersecurity, comprise of a cross-functional group of members with substantial professional and technical information technology experience, oversees the cybersecurity program to help ensure the confidentiality, integrity and availability of the company's systems and mitigate day-to-day threats and exposures. It is responsible for measuring and managing cybersecurity risk, including the prevention, detection, mitigation, and remediation of cybersecurity incidents and for implementing cybersecurity policies, programs, procedures and strategies. The security team reports significant cybersecurity incidents to senior management, internal legal advisors, communication specialists and other key stakeholders as required. COMPASS MINERALS INTERNATIONAL, INC.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the company's risk management process and the risk trends related to cybersecurity at least annually. The Audit and Risk Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the CISO briefs the Audit and Risk Committee on the company's information security and cybersecurity risk posture at least four times a year.

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees risks associated with cybersecurity threats. The Board's Audit Committee is central to the Board's oversight of cybersecurity risks and has primary responsibility for this area. The Audit Committee is composed of independent directors with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Chief Risk Officer ("CRO")

companyName: LogicMark, Inc.

ticker: LGMK


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We periodically assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. As part of the managed monitoring and remediation platform, the Company benefits from a $100,000 breach prevention warranty. Since its inception, the Company has not had a security breach, and has not incurred any resulting expenses, penalties or settlements.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee of the board of directors (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Director of IT who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our dedicated personnel are knowledgeable about our products and systems and experienced information systems security professionals and information security managers with many years of experience. Management regularly updates the Audit Committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports quarterly that cover, among other topics, the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.

companyName: Acutus Medical, Inc.


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risk s is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect us against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning, and d ata security assessments of third-party service providers as a part of vendor management.

companyName: Nine Energy Service, Inc.


text: Board of Directors Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the "Audit Committee"), oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), Chief Legal Officer ("CLO"), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. Then, the Audit Committee and such members of our management team report to the Board of Directors on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters. Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board of Directors and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: To date, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, as discussed more fully under Part I, "Item 1A—Risk Factors—Risks Related to Information Technology Systems," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security incidents of these types, and we may not be able to implement effective preventive measures against such security incidents in a timely manner.

companyName: Bumble Inc.

ticker: BMBL


text: Management leverages the collective expertise of the Company's information security function which reports to the Chief Financial Officer through the Company's Chief Information Security Officer ("CISO"). The CISO has served in this position for the Company since 2017, holds various relevant credentials including CISSP (Certified Information Systems Security Professional), and has extensive cybersecurity and privacy experience having served in information technology roles for over 35 years and cybersecurity leadership roles for 15 years. The CISO reports to the Audit Committee quarterly on information security matters, including, among other things, the Company's cyber risks and threats, any incidents or events, the status of projects to further strengthen the Company's information security systems, assessments of the Company's security program and the emerging regulatory and threat landscape. The CISO also briefs the full Board of Directors on cybersecurity matters at least annually. As described above, management informs the Audit Committee about prevention, detection, mitigation, resolution, and remediation of cybersecurity incidents quarterly and monitors such matters continuously. The Audit Committee reviews and discusses with management the quality and effectiveness of the Company's efforts to mitigate such risks and reports such findings to the Board of Directors.

companyName: OPENLANE, Inc.

ticker: OPLN


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cyber; incident. This includes a review of vendors during the selection/onboarding process, inclusion of formal service level agreements (SLAs) including requirements for uptime where applicable, and a periodic review of contracts.

companyName: Sachem Capital Corp.

ticker: SACH


text: Additionally, we engage an external firm to conduct an annual System and Organization Controls 2 Type 2 examination of certain cybersecurity controls, and additional third parties are engaged, as needed, to perform risk assessments, penetration testing, and other services related to cybersecurity. We rely on third-party cybersecurity software tools and services to enhance many of our cybersecurity functions, such as incident logging, network monitoring, security operations, and data loss prevention, among others. Additionally, we carry cybersecurity insurance to help reduce financial risk posed by cybersecurity incidents.

companyName: Unum Group

ticker: UNM


text: At the management level, our cybersecurity program is managed by our CISO, who reports to our Senior Vice President and Chief Financial Officer. Our CISO has over twenty-five years of information security experience.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: The Board regularly receives reports from our executive officers and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: Marvion Inc.

ticker: MVNC


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of company data and systems along with other material risks to company operations, at least annually or whenever there are material changes to the Company's systems or operations. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. As part of our risk management process, the Company engages outside providers to conduct periodic penetration testing and other cybersecurity audits. The Company stores company data in cloud environments with security appropriate to data involved and has adopted controls around, among other things, vendor risk assessment, information classification, access and acceptable use and backup and recovery.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, for additional discussion about cybersecurity-related risks.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes have processes in place to identify, review and evaluate cybersecurity risks associated with our use of third-party service providers.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats.

companyName: ASPAC II Acquisition Corp.

ticker: ASCBF


text: We design and assess our program using several industry-leading frameworks including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), Payment Card Industry Data Security Standard ("PCI-DSS''), and SOC2. With regards to the NIST CSF, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Eventbrite, Inc.

ticker: EB


text: Data Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Vertical Data Inc.

ticker: VDTA


text: The Company's Board of Directors (the "Board"), in coordination with its Audit Committee, oversees the Company's overall ERM process, and has delegated the management of risks arising from cybersecurity threats to the Security & Technology Committee, which regularly interacts with the Company's CSO (who maintains chief information security officer ("CISO") responsibilities at TTEC among other responsibilities), Chief Information Officer ("CIO"), the Chief Privacy Officer, Chief Legal & Risk Officer, and other members of management. The Security & Technology Committee of the Board receives regular reports on the Company's cybersecurity risks, vulnerability assessments, third-party and independent reviews, and the steps the Company is taking to address the security risks, among other relevant information, and shares information with the full Board as appropriate. The Board also has access to and periodically meets with the Company's CSO, CIO, and Chief Legal & Risk Officer about the approaches and progress that the Company is making on its cybersecurity risk management priorities.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: ANVI GLOBAL HOLDINGS, INC.

ticker: ANVI


text: We have engaged an outside consultant that assists our efforts to prevent threats toward our Information Systems. This consultant monitors data feeds from certain of our key Information Systems. The consultant notifies and works with the Company to investigate and resolve any potential cybersecurity threats identified.

companyName: Ubiquiti Inc.

ticker: UI


text: Some of the other steps we have taken to detect, identify, classify and attempt to mitigate data security and privacy risks include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures; • Conducting targeted assessments and penetration tests throughout the year, using both internal and external resources; • Conducting security maturity posture assessments, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a regular basis; • Utilizing industry-standard technologies, processes, and capabilities designed to protect our systems and data and detect potential suspicious activity; • Adopting a vendor risk management program, which includes cybersecurity and data privacy audits, classifying vendor, service provider or business partner risk based on several factors and evaluating and monitoring related risk mitigation efforts; • Providing security and privacy training and awareness to our employees; • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training; and • Maintaining cyber liability insurance.

companyName: Hanesbrands Inc.


text: o Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.

companyName: BlackRock Direct Lending Corp.


text: Our Board of Directors holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. Our Audit Committee takes a leading role in oversight of risk management, including risks related to cybersecurity, and receives reports from our management regarding cybersecurity risks and countermeasures being undertaken or considered by us, including updates on the internal and external cybersecurity landscape and relevant technical developments and more frequent reports as it may direct or as warranted. Our cybersecurity program is led by our Chief Information Officer, or CIO, who has over two decades of relevant experience in information technology and cybersecurity and has primary responsibility for assessing and managing material risks from cybersecurity threats and overseeing our cybersecurity team. Our CIO has previously held senior information technology and security roles, including as CIO of a global real estate firm and of a real estate investment trust. Our Director of Information Security and our cybersecurity team are responsible for, among other things, information technology failure mitigation and business continuity, cybersecurity threat detection and incident response and continuous network monitoring. Our cybersecurity team members have a broad array of relevant skills and expertise and have obtained, or are working to obtain, relevant information security certifications, including Certified Information Systems Security Professional, Certified Information Systems Auditor and Certified Risk and Information Systems Control certifications. Our Director of Information Security assembles our incident response and investigative teams and informs our CIO if an incident occurs. Investigative findings are reported to our executive leadership and to the relevant authorities if warranted. Our CIO works closely with our senior management, including cross-functional leaders in our human resources, legal and corporate communications departments, to develop and advance our cybersecurity strategy and reports to our Audit Committee on cybersecurity matters.

companyName: RMR GROUP INC.

ticker: RMR


text: Role of the Board Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity to the Audit Committee, which reviews and oversees our programs, policies, practices and safeguards relating to: information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and our cyberattack incident response and recovery plan. The Audit Committee receives regular reports from our Chief Information Officer (CIO) and CISO on, among other things, our cyber risks and threats, the status of measures to strengthen our cybersecurity systems, assessments of our Cybersecurity program, and our views of the emerging threat landscape. During fiscal 2024, substantially all of our directors attended the Audit Committee meetings in which the Committee received updates relating to cybersecurity.

companyName: Aramark

ticker: ARMK


text: Recognizing the cybersecurity and risk management programs are newly formed, we have established plans to conduct regular reviews and tabletop exercises to test processes for preparedness in case of a critical event as well as integrate cybersecurity risk with the Enterprise Risk Management Framework. As part of our risk management strategy, we have secured comprehensive cyber insurance coverage. We regularly review and update our cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Because we are a newly formed company, there are no historical internal or external assessment processes. Going forward, however, the Fortrea Internal Audit team will conduct internal assurance reviews as part of their 2024 annual audit plan. Additionally, as we continue to execute our risk management processes, we plan to engage external cybersecurity partners for the evaluation and assessment of our cybersecurity program and its capabilities.


text: The Director of IT engages with our managed service providers to proactively address emerging threats based on industry reports and respond to any threats and incidents. Our managed service providers also provide continuous support and coverage of our environment. We utilize threat intelligence services from multiple organizations, allowing us to proactively respond to emerging cybersecurity threats.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our audit committee oversees our ERM program, including the management of risks arising from cybersecurity threats, and are supported by the Information Security Steering Committee (the "ISSC"), the Cybersecurity Incident Response Team (the "CSIRT"), and our information security ("InfoSec") team. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The ISSC oversees the frameworks the InfoSec team uses to benchmark the controls and maturity of our security program. The ISSC is a cross-functional group that has oversight and input into the roadmap and projects reflecting the maturity benchmarks of the frameworks upon which we base our program, and receives monthly updates as to the status of the roadmap projects. The CSIRT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the ISSC, who then reports up to our audit committee when appropriate. The audit committee is responsible for escalating cybersecurity threats and incidents to the Board if and when appropriate. We have established frameworks so that our ISSC, audit committee, and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Redfin Corp


text: The Company has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations as part of our decision-making processes at every level. Our IT department and third party service providers seek to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinate with our overall risk management framework.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: 8x8 has developed and implemented a comprehensive Incident Response Plan, or IRP, to effectively manage cybersecurity incidents. The Incident Response Plan outlines clear reporting and escalation processes, delineating roles and responsibilities for incident response team members. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We use a variety of methods to oversee and identify material cybersecurity threats related to the use of third-party technology and services. By way of example, we perform diligence with respect to third parties, obtain contractual protections, and utilize third-party risk monitoring security rating services.

companyName: QXO BUILDING PRODUCTS, INC.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed with the BrightSpire IT Partner's attention to and integration of certain information security standards issued by the SEC, the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adaptation to and mitigation of new threats, leverage of internal team resources to focus on business priorities, and effectively meeting and managing evolving regulatory requirements in real time. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching, including four to six sessions each calendar year (addressing spam, phishing, information security protocols, use of social media); and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We migrated and maintain our company data and communication services to a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: We assess and identify material risks from cybersecurity threats primarily through the work of our Information Security organization, which is fully integrated in our enterprise risk management (" ERM ") process in close partnership with other functions such as Engineering, Industrial Security, Internal Audit, and Legal. The ERM process, administered by management with input from each business segment and function, continuously monitors material risks facing L3Harris, including cybersecurity threats. Our Information Security organization, is led by our Chief Information Officer (" CIO "), who has extensive experience leading information technology for global organizations across aerospace, defense and industrials, and works directly with our Chief Executive Officer (" CEO ") and other members of senior management to assess cybersecurity threats as part of the ERM process. The CIO oversees the internal cybersecurity organization of more than 100 full-time employees headed by our Chief Information Security Officer (our " Cybersecurity Team ").

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: For further discussion of cybersecurity risks, please refer to the "Risk Factors" section under the heading "General Risks Related to the Company."

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: We leverage the support of third-party information technology and security providers as part of our cybersecurity risk management program, including for penetration testing. Further, we have adopted written information security policies and procedures, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.

companyName: 10x Genomics, Inc.

ticker: TXG


text: Our Chief Information Security Officer ("CISO") and our Director of Global Cybersecurity ("Cybersecurity Director") lead our Detection and Response Team ("DART"), which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART consists of members of our IT department responsible for protecting against, detecting, containing, mitigating, and recovering from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents, and based on the severity, escalates and engages incident response teams based on severity, and responds to and mitigates the related risks.

companyName: AeroVironment Inc

ticker: AVAV


text: We are focused on addressing the growing threat of cybersecurity risks that we face in today's global business environment and have identified cybersecurity as an important enterprise risk. Our cybersecurity risk management program is part of our overall enterprise risk management program, and is focused on identifying, assessing, managing, and remediating material risks from cybersecurity incidents. We rely on risk-based security controls, including access limitations and contractual requirements on third-party service providers, as part of our overall approach of protecting the integrity, availability and confidentiality of our important systems and information. We have an established cyber incident response plan to respond to cyber incidents.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: The Board receives periodic reports from management on our cybersecurity risks and our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Digital Officer ("CDO") as part of the Board's continuing education on topics that impact public companies. In addition, management is prepared to update the Board, as it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: We have adopted a third-party due diligence assessment policy to define the procedures for assessing and identifying risk from cybersecurity threats associated with the use of any third-party vendor who interacts with Liquidia's technology infrastructure or Liquidia's confidential, proprietary, or personally identifiable information. Under this policy, cybersecurity risks are identified and evaluated as part of the selection and oversight of applicable third-party service providers.

companyName: Liquidia Corp

ticker: LQDA


text: In general, cybersecurity incidents can result from deliberate attacks or unintentional events such as a cyber-attack against USCF, a natural catastrophe, an industrial accident, failure of USL's disaster recovery systems, or consequential employee error. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of a fund's clearing broker or third party service provider (including, but not limited to, index providers, the administrator and transfer agent, the custodian), have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of fund shareholders to transact business, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company, there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect on our business strategy, results of operations or financial condition. For examples of such matters and a discussion of the risks that we face, see Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. However, we have not identified risk from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.

companyName: AMGEN INC

ticker: AMGN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program. Our key cybersecurity risks include, among others, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; remote working environments; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.

companyName: Sabre Corp

ticker: SABR


text: We recognize the critical importance of cybersecurity and data privacy in safeguarding our operations, sensitive data, and maintaining the trust of our stakeholders. We acknowledge the significance of cybersecurity incidents and threats as potential risks that may impact our operations and information systems. We have developed and implemented cybersecurity and data privacy programs in accordance with the requirements of ISO standards 27001:2022 and 27701:2019, which are intended to appropriately preserve the confidentiality, integrity, and availability of information maintained by our company. These programs identify, select, maintain, operate, and improve cybersecurity and privacy controls.

companyName: EXPONENT INC

ticker: EXPO


text: We have an incident response plan and processes in place for responding to cybersecurity incidents. The process includes steps to identify, contain, investigate, and remediate the impacts of the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. The plan involves the participation of a security incident response team that includes our Chief Legal Officer, our Privacy Officer, and other senior leaders in finance, communication, human resources, and legal. The plan includes procedures to communicate the incident to management and customers as appropriate and to provide information as required to state and federal law enforcement and regulatory bodies.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: To address and mitigate cybersecurity risks from third-party systems, the Company implements a stringent process that includes SOC 1 and SOC 2 compliance. These standards help ensure that our third-party vendors maintain appropriate security controls and processes. Additionally, we enter into Business Associate Agreements (BAAs) with relevant third-party vendors. These agreements are critical for reinforcing our cybersecurity framework, as they require vendors to maintain the confidentiality, integrity, and availability of protected health information according to our standards and federal regulations. Additionally, through third-party risk assessments, regular audits, and the enforcement of security requirements, we seek to ensure that all vendors adhere to our standards of data security and privacy. This layered security approach, incorporating both technical compliance and legal agreements, helps to create a defense against external cyber threats.

companyName: Pennant Group, Inc.

ticker: PNTG


text: We maintain a Business Continuity and Incident Response Program that provides a documented framework for responding to actual or potential incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our chief executive officer and board of directors as appropriate.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Plans have a comprehensive incident response plan with detailed procedures for addressing ransomware attacks and other cyber threats, in an effort to provide a swift and effective response. Coordination: Our IT and security teams collaborate seamlessly during incidents to respond quickly, contain threats, and minimize impact.

companyName: Health In Tech, Inc.

ticker: HIT


text: Day-to day management of cybersecurity threats is conducted by our Information Technology department in conjunction with outside service providers, which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Chief Executive Officer and Chief Financial Officer, who are expected to report to the Audit Committee.

companyName: AiXin Life International, Inc.

ticker: AIXN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks related to our business—Our information technology systems, or those used by our third-party contract research organizations or other contractors or consultants, may fail or suffer security breaches."

companyName: CARGO Therapeutics, Inc.


text: As operators of critical infrastructure, the Company may face a heightened risk of cyberattacks from internal or external sources. Unauthorized access to confidential information located or stored on these systems could negatively and materially impact customers, employees, suppliers and other third parties. Further, third parties, including vendors, suppliers and contractors, who perform certain services or administer and maintain our sensitive information, could also be targets of cyberattacks and unauthorized access. While the Company has instituted safeguards to protect the information technology systems, those safeguards may not always be effective due to the evolving nature of cyberattacks and cyber vulnerabilities. The Company cannot guarantee that such protections will be completely successful in the event of a cyberattack.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Our business, financial condition and results of operations have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A—"Risk Factors" of this Annual Report on Form 10-K.

companyName: First Foundation Inc.

ticker: FFWM


text: The Company's management responsible for developing and executing Dow's cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant experience in security related industries. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: DOW INC.

ticker: DOW


text: 8x8 engages reputable external security firms and consultants to support ongoing evaluations, and has obtained certifications and attestations across various jurisdictions and industries (including ISO/IEC 27001, CyberEssentials Plus et al, and compliance with frameworks applicable to communications and cloud service providers).

companyName: 8X8 INC /DE/

ticker: EGHT


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management. The Board of Directors reviews material cybersecurity risks we face, approves strategic priorities, and monitors progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management our policies and procedures with respect to cybersecurity risks and the processes management has implemented to monitor and mitigate those risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity policies and standards, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.

companyName: Ingredion Inc

ticker: INGR


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board of Directors members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff and/or external experts, as appropriate, as part of the Board of Directors' continuing education.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: Our cybersecurity program is managed by our executive management team, including our Chief Executive Officer and Chief Technology Officer, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and received analysis reports from a cybersecurity advisor, and generally rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: Our Vice President of IT and Director of IT Operations are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Vice President of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Poseida Therapeutics, Inc.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below. The IRP is coordinated through the Chief Finance/Information Security Officer, Senior Technology/Cybersecurity Officer and key members of management are embedded into the IRP by its design. The IRP facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: The Company has information technology security practices designed to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: Cybersecurity controls embedded in the Company's information technology systems; Regular implementation of changes to the Company's information technology systems to address potential threats and vulnerabilities; Incident response program, including proactive simulations to identify and manage cybersecurity threats, risks and incidents; Participation in industry forums and collaboration with peers; and Security awareness and data protection training for applicable employees.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance: As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd. ("AHL"), a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with the Company's executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with the Company's management and its board of directors, as applicable, in a timely manner. • Technical Safeguards: Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as the Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Realty Income Solutions, Inc.


text: Board of Directors Oversight and Management's Role Managing Risk The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The CSO is responsible for informing the Audit Committee on cybersecurity risks and presents to the committee at least semi-annually. Additional discussions with the Audit Committee or the full Board of Directors may occur on an as-needed basis. These briefings encompass various topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: HashiCorp, Inc.


text: The Audit Committee reviews the effectiveness of the Company's governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management. The Audit Committee, at least annually, reviews and considers the results of our ERM process, including as it relates to risks from cybersecurity threats, and provides updates, as appropriate or required, to management and the Board.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Audit Committee of our board of directors is charged with oversight of data privacy and cybersecurity risks. Our CISO provide annual updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full board of directors at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the board of directors on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CISO discusses and presents strategies to address technological changes, such as AI. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. Outside counsel advises the board of directors on best practices for cybersecurity oversight by the board of directors, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.

companyName: EGAIN Corp

ticker: EGAN


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies.

companyName: Ladder Capital Corp

ticker: LADR


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: As part of our commitment to maintaining the integrity, confidentiality, and availability of our information assets, the Company places a significant emphasis on cybersecurity. The Company's risk management program is designed to comply with laws and regulations applicable to cybersecurity. The Board is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. The Company's management, including its Director of Information Technology, is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. Our Director of Information Technology has served in similar roles in information technology and information security for over 20 years. He holds an undergraduate degree in Management Information Systems. Our strategies, policies, and initiatives aimed at protecting our systems and data against potential threats are outlined below.

companyName: HG Holdings, Inc.

ticker: STLY


text: We maintain a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. This program is to ensure that cybersecurity considerations are included in decision-making processes throughout the Company.

companyName: LQR House Inc.

ticker: YHC


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("Security breaches of either confidential guest information in connection with, among other things, our electronic processing of credit and debit card transactions or mobile ordering app, or confidential employee information may adversely affect our business" and "Failure to comply with privacy and cybersecurity laws and regulations could cause us to face litigation and penalties that could adversely affect our business, financial conditions, and results of operations.").

companyName: BurgerFi International, Inc.


text: We take a comprehensive and forward-looking approach to cybersecurity risk management under the oversight of our Audit Committee. Management, including our Chief Financial Officer and our Director of Information Technology, provide regular updates to ensure a strategic, unified response to cybersecurity challenges. Management is notified of, and monitors, cybersecurity incidents through our EDR and SIEM systems.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our business and operations have been impacted in the past, and may be impacted in the future, in the event of system breach or failure" and "Complying with laws in the U.S., Europe, and other jurisdictions that impose restrictive regulations addressing the collection, use, and other processing of personal information may be expensive, and failure to comply with such laws and regulations could cause substantial harm to our company.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Audit Committee of the Board has the ultimate oversight responsibility relating to risk management of cybersecurity.

companyName: enCore Energy Corp.

ticker: EU


text: To date, our business strategy, results of operations and financial condition have not been materially affected, nor are they reasonably likely to be affected by risks from cybersecurity incidents or threats. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: TransMontaigne Partners LLC


text: Our Board of Directors is primarily responsible for overseeing and governing our cybersecurity risk management program. The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We rely upon in-house and cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: a cyber resilience team jointly responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a designated team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management and • a third-party risk management process for certain service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Funko, Inc.

ticker: FNKO


text: Our Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: IMMERSION CORP

ticker: IMMR


text: The day-to-day cybersecurity program is led by the Company's Vice President, IT Infrastructure & Information Security. This role is supported by a dedicated security team and reports directly to the Chief Executive Officer. The Vice President, IT Infrastructure & Information Security provides formal, quarterly updates to the Cyber Security Risk Management Committee. These updates cover cyber risk management governance, the status of ongoing efforts to strengthen cybersecurity effectiveness, key risk metrics and the material outcomes of risk assessments, and significant cybersecurity-related news events impacting the industry. In addition to scheduled reports, the Board of Directors engages in ad hoc conversations with management to discuss any significant updates to our cybersecurity risk management and initiatives, particularly in response to emerging threats.

companyName: PHOTRONICS INC

ticker: PLAB


text: We are committed to continuously assessing cybersecurity risks, including the prevention, detection, and response to unauthorized actions within our information systems that may compromise the confidentiality, integrity, or availability of our data or systems. We are using Layer 7 firewall solutions which monitor web traffic and data leaks which may occur as well as a centralized automatic antivirus/antimalware/patch system in order to make sure that all servers and clients hold the latest patches in order to avoid security breaches. We have developed our own internal cloud system to avoid dependence on external parties and its email server is hosted on this cloud system; consequently, we do not rely on third party solutions that may have a negative impact on security and reliability of data. Our data is stored daily on high quality magnetic tapes to ensure recovery in case of a serious malfunction. On a monthly basis, all the tapes are being transferred to a fireproof safe location and are replaced with new tapes.

companyName: Elvictor Group, Inc.

ticker: ELVG


text: Our cybersecurity program is designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems. Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and leverages the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: PARSONS CORP

ticker: PSN


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors - We and our manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: We have processes and standards to address cybersecurity matters and mitigate material cybersecurity risk. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, encryption standards, access controls, disaster recovery/business continuity plans, incident detection and response, antivirus protection, remote access security, and multi factor authentication. All employees are required to complete cybersecurity trainings at least once a year.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems. At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. These events also have carried significant reputational risk for the successfully targeted institutions. In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents. That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems.

companyName: OP Bancorp

ticker: OPBK


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The Company's cybersecurity team briefs the Audit Committee on the effectiveness of the Company's cybersecurity risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Company's Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: Our global cybersecurity program is subject to an annual third-party assessment overseen by our board of directors and this assessment reviews all aspects of our cyber program. Findings are reported to our board and, in response, ADP develops initiatives to improve our maturity across each of the pillars of the NIST Cybersecurity Framework. The status of these initiatives is then reviewed with our audit committee during its quarterly meetings. This governance process encourages an environment of continuous improvement. In advance of these quarterly meetings, members of our audit committee with cybersecurity expertise informally meet with our CAO, CSO, and other members of leadership, as appropriate, to advise and provide additional guidance and industry insights to the Company.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported by the Chief Information Security Officer (CISO) to certain senior leaders, the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: PFIZER INC

ticker: PFE


text: To date, the increase in cyberattacks has not resulted in any material disruption of our operations or material harm to our customers or patients. However, while we have significant internal resources, policies and procedures designed to prevent or limit the effect of the possible failure, interruption or security breach of our information systems, there can be no assurance that any such failure, interruption or security breach will not occur in the future, or if they do occur, that they will be adequately addressed. Please also reference additional disclosures about cybersecurity in Item 1A Risk Factors, under both Roto-Rooter and VITAS sections.

companyName: CHEMED CORP

ticker: CHE


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third -party systems.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security program is overseen by our VP of Information Technology, supported by corporate leadership from legal and finance. Our VP of Information Technology and the support team is accountable for the program. Our function and business unit executive leadership, acting in support of the VP of Information Technology and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Data Privacy Officer, are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.

companyName: Simulations Plus, Inc.

ticker: SLP


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives periodic briefings from management on our cybersecurity program. The Board members receive presentations on cybersecurity topics from our IT Senior Director, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ARDELYX, INC.

ticker: ARDX


text: SOC 2 Type II audits assess risks from interactions with the Company's systems, particularly information about system controls that the Company has designed, implemented, and operated to provide reasonable assurance that its service commitments and system requirements were achieved based on the SOC 2 trust services criteria.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Management has established a cyber incident response plan (CIRP) designed to assess, identify and manage risks from cybersecurity threats and enable prompt response in the event that a cybersecurity incident is detected. We have a process in place for notification to our leadership response team in the event of a significant cyber incident, and for escalation of these events to our Audit Committee and Board, as appropriate. To date, we have not experienced a cybersecurity incident that has had a material impact on our business strategy, results of operations, or financial condition.

companyName: Moderna, Inc.

ticker: MRNA


text: Cybersecurity Governance; Management Cybersecurity is an important part of our broader risk management processes and an area of focus for our Board of Directors and management. In general, o ur Board of Directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and o ur Board of Directors has authorized our Audit Committee to oversee risks from cybersecurity threats.

companyName: Quantum-Si Inc

ticker: QSI


text: Board of Directors is tasked with overseeing data privacy and cybersecurity risks. They regularly review the Company's cybersecurity program with management, evaluating the adequacy of controls and security for our information technology systems. Additionally, they assess the Company's response plan in case of a security breach affecting these systems. Annually, the Board of Directors receives updates on potential cybersecurity incidents, data privacy, and compliance programs, engaging in active discussions with management on cybersecurity risks.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, cybersecurity consultants, cyber security software providers and penetration testing firms.

companyName: SunPower Inc.

ticker: SPWR


text: Based on our business model, we rely on the outsourcing of certain key business functions, including laboratory work, clinical research, and the manufacturing and distribution of our product. We utilize the vetted processes and procedures of these partners and ensure proper cybersecurity and risk mitigation strategies are in place and functioning, which is accessed through our Vendor Risk Assessment process prior to engaging with our partners. Our cybersecurity risk identification, assessment and management response process is a critical part of our overall enterprise risk management, or ERM, program. Within our ERM framework, we adhere to our Global Information Technology Policy, or IT Policy, among a host of other policies and procedures aimed at providing guidelines and standards to ensure the security, integrity, reliability and recoverability of our systems and infrastructure.

companyName: AMARIN CORP PLC\UK

ticker: AMRN