text: Risks from Cybersecurity Threats We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Our Board of Directors, in coordination with the Audit Committee, oversees our risk management program, including the management of cyber threats. The Board of Directors and senior management are actively involved in reviewing our information security and cybersecurity strategies and updating as risks evolve.

companyName: Intrepid Potash, Inc.

ticker: IPI

secItem: Item 1C


text: Risk management and strategy Jocom Holdings Corp. acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: JOCOM HOLDINGS CORP.

ticker: JOCM


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The Risk Committee meets no less than quarterly and provides oversight of PNC's ERM framework. Cybersecurity risk is integrated into PNC's overall ERM framework, and is represented as the Information Security domain, alongside seven other operational risk domains. See the Risk Management section in Item 7 of this Report for more details on our ERM framework.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals information security team, who reports to the Secretary of the General Manager at Gyre Pharmaceuticals, comprises of three employees with an average of 20 years of experience managing information technology and cyber security matters. The Secretary of the General Manager reports to the General Manager at Gyre Pharmaceuticals, and the General Manager reports to the Board of Directors and is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please see Item 1.A. "Risk Factors" of this Annual Report on Form 10-K, including the risk factors titled "—Security breaches and incidents compromising borrowers' confidential information that we store may harm our reputation, adversely affect our results of operations and expose us to liability".

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Our business requires us to share data, and have our systems interact, with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors. This interaction and sharing of data creates risks to our systems and makes us vulnerable to third party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies and includes cybersecurity team assessments of third party products and systems proposed to connect to our information systems or access or store our data. A subgroup of our cybersecurity team is dedicated to risk assessment analyses of vendor security practices and protections. We leverage the FAIR (Factor Analysis of Information Risk) model to help quantify the third party's cyber risk. We endeavor to incorporate security measures into contracts with vendors. In addition to protecting our assets and systems, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan, updated annually, that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management. We have a cybersecurity incident response team composed of a smaller, core group of our cybersecurity team. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.

companyName: Ardent Health, Inc.

ticker: ARDT


text: We recognize the need to continually monitor and assess material risks associated with cybersecurity threats as such term is defined in Item 106(a) of Regulation S-K. Additionally, we maintain a comprehensive risk management framework designed to respond quickly to perceived threats and mitigate the impact of a cybersecurity incident. Some of the cybersecurity risks we face include - but are not limited to - unauthorized access of sensitive information, breach of critical systems resulting in loss of constellation control, and denial of service of critical systems.

companyName: Spire Global, Inc.

ticker: SPIR


text: For a discussion of risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" under the heading "We are vulnerable to cybersecurity attacks and threats." (Part I, Item 1A of this 2024 Form 10-K).

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: Risk management is a central part of our cybersecurity program. We conduct regular risk assessments and monitor our information systems for potential vulnerabilities. We employ a risk quantification model to identify, measure, and prioritize cybersecurity and technology risks, and we implement corresponding security controls and safeguards based on model outputs. In addition to cybersecurity risks being tracked, managed, and monitored directly by the information security group, cybersecurity risks are also integrated into, and are among the risks evaluated and considered by, our enterprise risk management program. The Company's Chief Legal Officer provides centralized oversight of our enterprise risk management program, which is managed by our Chief Compliance Officer and the Office of Enterprise Risk Management in partnership with the Enterprise Risk Council (ERC). The ERC is comprised of senior Company leaders with broad enterprise experience, including our Chief Information Security Officer (CISO).

companyName: LOWES COMPANIES INC

ticker: LOW


text: The Board Risk Committee reviews and receives regular briefings from the Chief Information Officer, Chief Information Security Officer (the "CISO"), Chief Technology Officer, Chief Operating Officer, Chief Risk Officer, Senior Vice President – Enterprise Information Security, Chief Audit Officer, and Chief Executive Officer on information security and technology risks, including discussions of the Company's information security and cybersecurity risk management programs. The Board also receives regular reports on cybersecurity risks, vulnerabilities, incidents, staff security awareness training and overall progress to improve the Company's cybersecurity risk profile.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: As an active participant in the biopharmaceutical industry, our company operates within a landscape fraught with diverse cybersecurity risks. These risks have the potential to significantly impact our business, financial standing, and operational outcomes.

companyName: BeyondSpring Inc.

ticker: BYSI


text: Our information security program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through established policies, standards, reference architectures, and the use of enterprise security services that focus on emerging and ongoing cybersecurity risks. Our proactive management of cybersecurity risks entails many actions, including the maintenance of system access restrictions, utilization of data security technology, employee education and training initiatives, and retention of cyber liability insurance, among other measures. We regularly engage third-party auditors and consultants and leverage our internal audit function to assess various facets of our cybersecurity program. These engagements include completion of industry-standard assessments or certifications, maturity model reviews, threat simulations, as well as internal reviews to assess the effectiveness of our cybersecurity processes. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. As examples, we generally review current and prospective third-party service providers for unacceptable cybersecurity risks, negotiate contractual provisions that require the establishment of third-party cybersecurity controls, and deploy communications security measures to protect third-party communications.

companyName: ELI LILLY & Co

ticker: LLY


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information maintained in them.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: We also utilize third-party service providers as a normal part of our business operations. These third-party service providers may have access to our systems and/or sensitive information. To address cybersecurity risks arising from our third-party service providers, we assess and monitor risks relating to potential compromises of sensitive information at our third-party service providers and reevaluate these risks periodically. We categorize our third-party service providers by criticality, based on the criticality and sensitivity of our data each third-party service provider has access to, and, based on this, we employ a risk-based approach for review of the security measures implemented by our third-party service providers. In addition, we obtain periodic attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: We have only four employees and so disclosure of cybersecurity events to management would occur organically, or would in the first instance be observed by management.

companyName: AIxCrypto Holdings, Inc.

ticker: AIXC


text: Our third-party IT vendors undergo independent audits to validate their compliance with System and Organization Controls ("SOC") 1 and SOC 2 standards. Vendor access to our networks is restricted to the applications necessary for their services. We proactively assess vendor risk using third-party rating tools, quantifying vulnerabilities and engaging vendors in remediation efforts to mitigate potential security threats.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Key aspects of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, and information; • an internal security staff principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors, including cloud-related service providers.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: Foundationally, our cybersecurity framework is based upon the National Institute of Standards and Technology for Improving Critical Infrastructure Cybersecurity and is also designed to incorporate elements from additional industry standards, such as those of the Federal Financial Institutions Examination Council, to better suit the Company's cyber risk profile. In addition, our cybersecurity framework incorporates internal and third-party capabilities that drive the development and implementation of our data security strategy, which is designed to reduce cybersecurity risk while enabling Truist's corporate business objectives.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Although we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: ACORN ENERGY, INC.

ticker: ACFN


text: We maintain a network and information security program that is reasonably designed to protect our information, and that of our customers, from unauthorized risks to their confidentiality, integrity, or availability. Our program encompasses the CSO and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers; and the program is generally designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution.

companyName: AT&T INC.

ticker: T


text: In 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."

companyName: Royalty Pharma plc

ticker: RPRX


text: Sponsor will maintain reasonably up-to-date firewall protection (if applicable) and operating system security patches, reasonably designed to maintain the integrity of the personal information, installed on systems processing personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Our cybersecurity programs are managed under the direction of CEO and MIS consultant, and MIS supervisor monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. MIS supervisor regularly updates the CEO on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides regular cybersecurity updates.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: Our Board of Directors is responsible for understanding the primary risks to our business, including any cybersecurity risks. Our Board of Directors may receive periodic updates from our Chief Compliance Officer, our General Counsel, our Chief Operating Officer or from our Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting our business.

companyName: Senior Credit Investments, LLC


text: Our Incident Response Plan ("IRP") establishes the incident response ("IR") policies and procedures to position our organization to timely and effectively address cybersecurity incidents that could, or may have, compromised sensitive and/or personally identifiable information ("PII"), or have a serious impact on our ability to accomplish our mission. The IRP also specifies the organizational methods for the preparation, detection, analysis, eradication, and containment of an incident. The IRP describes the roles, responsibilities, and actions of the Incident Response Team ("IRT") to analyze, classify, and manage security events and incidents, including but not limited to, unauthorized access, alteration or compromise, denial of service, malicious code, or misuse.

companyName: INSTRUCTURE HOLDINGS, INC.


text: For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Information Technology and Cybersecurity" in "Risk Factors" in Part I Item 1A of this annual report.

companyName: Freedom Holding Corp.

ticker: FRHC


text: In the event of a cybersecurity or data privacy incident, our triage team evaluates the probable frequency and magnitude of potential loss. Incidents are categorized by severity and escalated to the CIO, Chief Executive Officer, and the Senior Vice President, General Counsel, and Corporate Secretary ("Legal Counsel"), who determine any additional communication or disclosure requirements. The Board of Directors is notified of high-severity incidents. Each incident is followed by a formal investigation, root cause analysis, and remediation plan. Additionally, our cyber insurance program is reviewed regularly to ensure adequate coverage in support of our layered protection model.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President, Program Management, Corporate Infrastructure, and Clinical Operations. Ms. Hegg provides information technology and cybersecurity reports a necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: The Senior Director of Information Security oversees the Information Security Steering Committee ("Steering Committee"), which provides education on the Company's cybersecurity programs and controls to key members of the Company. The Steering Committee meets quarterly and is comprised of members from the Executive Leadership Team, including the Chief Financial Officer and Executive Vice President of Business Affairs, as well as the SVP of Information Technology, Senior Director of Information Security, VP of Corporate Communications, SVP of Digital Innovation, and Head of Global Human Resources.

companyName: SKECHERS USA INC


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST"). We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: NOVANTA INC

ticker: NOVT


text: We have established processes to ensure that management is informed about and monitors cybersecurity threat prevention, detection, mitigation, and, if necessary, cybersecurity incident remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of our cybersecurity and data privacy program.

companyName: Certara, Inc.

ticker: CERT


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: a third-party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and dark web monitoring services.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: The Partnership's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Partnership has implemented or is in the process of continuously evaluating, testing and updating various information security processes and policies designed to identify, assess and manage material risks from cybersecurity threats to the Partnership's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Partnership's residents' and employees' personal data.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: Before purchasing third party technology or other solutions that involve exposure to the Company's assets and electronic information, our information technology team requires those companies to complete a security review before being approved to work with the Company.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency such as artificial intelligence, cloud computing, and machine learning may further expose our computer systems to the risk of cybersecurity incidents.

companyName: Shutterstock, Inc.

ticker: SSTK


text: The Vice President of IT is responsible for implementing and maintaining the information security program. The Vice President of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Vice President of IT reports to our CFO, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our CFO meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of risk remediation and ongoing implementation of cybersecurity improvements across our organization.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: The Company's assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is identified in the Company's risk register detailing certain known and potential risk items; the Company's IT operations department works with our MSSP/MSP vendor partners to review certain identified threats and our cybersecurity practices in an effort to prioritize and mitigate cybersecurity threats that are more likely to lead to a material impact on our business; and our CIO regularly presents to senior management, the Board and Audit Committee to evaluate material risks relative to our overall business objectives.

companyName: TerrAscend Corp.

ticker: TSNDF


text: As part of the cybersecurity risk management program, the Company has a set of Company-wide cybersecurity policies and procedures, including an Acceptable Use Policy as well as other policies covering subjects such as Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Media Protection, System and Communications Protection and Incident Response. These policies and procedures go through an internal review process and are approved by appropriate members of management. The Company requires all personnel, including contingent workers and business partners handling information on the Company's behalf to follow its cybersecurity policies and procedures. Regular training modules educate the Company's team members on relevant cyber threats and trends and help prepare them for real-life phishing threats.

companyName: OSHKOSH CORP

ticker: OSK


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident, (iii) containment, eradication, and recovery, and (iv) post-incident analysis. Such incident responses are overseen by our Leadership Committee comprised of our Chief Operating Officer, Chief Financial Officer, General Counsel and Senior Vice President of FP&A.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: Our global cybersecurity team is composed of multidisciplinary Information Technology ("IT") professionals from key regions, led by our Global Director of Cybersecurity. This team is responsible for providing comprehensive reporting to executive management and auditors, covering cybersecurity threats, assessments, findings and strategic direction for future improvements.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Risk Management Strategy We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.

companyName: Shimmick Corp

ticker: SHIM


text: Our IT security incident response plan is designed to escalate certain cybersecurity incidents to our IT Security Council depending on the circumstances. Our IT Security Council is made up of our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Secretary, Vice President of Data Sciences and IT, and Director of IT. Based on the severity and materiality of the incident, the Company's IT security incident response plan also includes reporting to the Audit Committee of the Board of Directors for cybersecurity incidents. In addition, the Audit Committee receives regular reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: OmniAb, Inc.

ticker: OABIW


text: On April 5, 2024, Targus discovered that a threat actor gained unauthorized access to certain of Targus' file systems. Upon discovery and with assistance from external cybersecurity counsel and consultants, Targus immediately activated its incident response and business continuity protocols to investigate, contain, and remediate the incident. Through this process, proactive containment measures to disrupt unauthorized access resulted in a temporary interruption in the business operations of the Targus network. The incident has been contained and Targus systems recovery efforts are in process. While the investigation is ongoing and the incident has temporarily disrupted Targus' business operations, as of the date of this filing, the Company does not currently believe that this incident will materially impact the Company's financial condition or results of operations taken as a whole. Business operations for each of the Company's other subsidiaries have continued without disruption in all material respects, and no other Company business has been affected. Targus' systems are not shared with or connected to the systems of other Company businesses and no other Company business has been affected. Targus has notified relevant regulatory authorities and will work with law enforcement with respect to the unauthorized access to information.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Depending on the environment, product, or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, vulnerability management processes, implementing certain security certificates for certain functions of our business; encrypting certain data, using network security controls; segregating data; maintaining access and physical security controls; managing, tracking, and disposing of assets; monitoring our systems; and maintaining cybersecurity insurance.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Management's Role in Cybersecurity Risk Management We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. The current CISO has 15+ years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training and incident response. The CISO's credentials include a Master of Science Degree in Information Security Management from SANS Technology Institute and a CISO Certificate from Carnegie Mellon University. The CISO holds multiple certifications including CISSP, GCIH, GCIA and PMP. Pursuant to our formal CIRP, suspected cybersecurity incidents are first evaluated by the Carpenter Technology Cybersecurity Team Leader who follows the guidance as outlined in the CIRP to respond to cybersecurity incidents and escalate as necessary based on a defined severity matrix. Based on the nature and severity of the incident, the response team may be comprised of representatives from our Information Technology, Human Resources, Safety, Legal, Finance and Communications departments, who jointly determine if the incident may result in a business interruption, require reporting to regulators, employees and/or business partners, have a material financial impact or cause reputational harm and should be escalated to the executive crisis response team, which includes Chief Executive Officer, Chief Financial Officer and General Counsel. For all matters that have been escalated, the responsible team executes specified procedures to contain the incident, implement incident response procedures and implement and document remediation measures.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor single-sign on authentication for all employees into line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: VINEBROOK HOMES TRUST, INC.


text: We describe risks faced by us from identified cybersecurity threats in Item 1A, "Risk Factors—Risks Related to Our Operations— Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could each result in material harm to our business and reputation", "Risk Factors—Risks Related to Our Operations—Manufacturing, quality, or supply chain difficulties, disruptions, or shortages could lead to product supply problems" and "Risk Factors—Risks Related to Our Operations—Reliance on third-party relationships and outsourcing arrangements could adversely affect our business."

companyName: ELI LILLY & Co

ticker: LLY


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and periodically reports to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: If a potential cybersecurity breach were to be identified, management would implement its incident response plan. This plan, which provides for a quick, effective and orderly response to information security incidents relies on our Incident Response Team ("IRT") to report findings to management and the appropriate authorities as necessary. The IRT, comprised of various cross-functional subject matter experts, is also responsible for: a.detecting and analyzing suspicious events that might indicate a breach has occurred; and b.containing, eradicating and restoring normal operations through quick responses, isolating and preserving evidence to aid in remediation and assisting investigators, isolating additional systems from being impacted by the situation being remediated, tracking issues, communicating a strategy and protocol to follow to maintain control of information and confidentiality and to ensure members of the IRT and Westwood management are kept informed of issues as the incident develops and is resolved, and developing and implementing strategies for ensuring the integrity of impacted information systems and critical information hosted on those systems.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: The IT team brings over 25 years of collective experience in senior management, web, and application development. Working in close alignment with the CEO and executive leadership, the team maintains a strong understanding of the company's business priorities, risk landscape, and governance requirements in-house capability is further enhanced by a long-standing partnership with an outsourced IT provider with over 23 years of operation, offering access to a broad pool of expertise, including on-demand virtual CTO and CISO services.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The Corporation understands the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Corporation collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and Enterprise Risk Management Committee, provide direction and oversight of the enterprise-wide risk management program of the Corporation, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Corporation.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in our management, including our S VP of IT and Facilities, who has over 30 years of IT experience, including 10 years of information security experience, in various IT leadership roles in life sciences companies.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Processes for the Identification of Risks from Cybersecurity Threats The Compliance Committee, working with the CISO and the Information Security team, has developed a cybersecurity risk management program that aims to address the following key areas: • Identification of assets at risk from cybersecurity threats; • Identification of potential sources of cybersecurity threats; • Assessment of the status of protections in place to prevent or mitigate cybersecurity threats; • Approaches to mitigating and managing the material cybersecurity risks; and • A process for regular reporting to the Compliance Committee and Board of Directors (directly and through the Audit Committee).

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, have the potential to materially affect our operations and, therefore, our results of operations and/or financial condition. For more information about these risks, refer to the risk factor captioned "Despite implementing and maintaining industry standard security measures and controls, the website, systems, and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales." in Part I, Item 1A. "Risk Factors.".

companyName: NET Power Inc.

ticker: NPWR


text: We have implemented and maintain an information security program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct periodic assessments of our assets as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We maintain an incident response plan that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: We execute targeted cybersecurity assessments of suppliers, evaluating their risk profiles and using a rating mechanism to identify vulnerabilities. We also partner with primary suppliers to implement advanced security measures to safeguard their information technology systems and have data security provisions in our contracts with third parties that handle our data.

companyName: PVH CORP. /DE/

ticker: PVH


text: Cybersecurity Risk Management Strategy We have implemented various processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. Our cybersecurity risk management strategy is designed following the Cybersecurity Framework set by the National Institute of Standard and Technology, or NIST.

companyName: LeonaBio, Inc.

ticker: LONA


text: We have not identified an indication of a substantive cyber security incident that would have a material impact on our business, results of operations or financial statements. Management and our Board recognize that this is an evolving environment and therefore our analyses of the risks and risk management are also evolving. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," above.

companyName: UR-ENERGY INC

ticker: URG


text: Our Risk Management Committee, which includes the Company's Chief Risk Officer (Chair), Director of Risk Management and CSO, assesses and monitors the effectiveness of the Company's cybersecurity risk management program. The Company's internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to protect our information systems and protect the confidentiality, integrity, and availability of our data. Presently our information systems are limited to databases maintained by third parties. As a result, we have limited policies and procedures to assess, identify, and manage material risk from cybersecurity threats. We assess risks from cybersecurity threats against our third-party information systems that may result in adverse effects on our information systems or any information residing therein. We conduct periodic and ad-hoc assessments to identify cybersecurity threats. Presently we do not believe there are any material threats to our systems.

companyName: GROOVE BOTANICALS INC.

ticker: GRVE


text: We rely on our management and third-party service providers to manage any perceived cybersecurity threats and risks. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, internal controls within our accounting and financial reporting functions, network security controls, access controls, physical security, systems monitoring, and employee training.

companyName: Trinity Place Holdings Inc.

ticker: TPHS


text: The Company has developed incident response plans to contain, investigate, respond to and recover from cybersecurity incidents. Our response plans require prompt notification to members of senior management in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We contract with external firms to assess the Company's cybersecurity framework. In connection therewith, such firms conduct cybersecurity risk assessments, cybersecurity incident response, provide internal and external penetration testing and ongoing training to our Cybersecurity Group. The Company maintains a cybersecurity insurance policy. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems and third-party service providers.

companyName: TransMontaigne Partners LLC


text: As a regulated financial institution, ACNB Bank is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation" included in Part I. Item 1 – Business of this report.

companyName: ACNB CORP

ticker: ACNB


text: Our board of directors is involved in the oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our board of directors has delegated authority to the Audit Committee to serve as the cybersecurity oversight body, which works with the chief financial officer to assess and respond to cybersecurity threats. The chief financial officer meets with the third-party vendors regularly to discuss any issues and updates related to the Company's information technology environment and reports to the Audit Committee on a quarterly basis.

companyName: Enveric Biosciences, Inc.

ticker: ENVB


text: Employees and directors with login credentials are required to participate in trainings on at least a quarterly basis to identify potential cybersecurity risks, which are supplemented by periodic phishing tests; Seaboard engages independent third parties to perform some services such as a penetration test; Seaboard maintains end user and administrative user policies governing the use of company technology.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Our CISO has served in this position since 2021 and has over two decades of experience in developing robust security programs across various industries. His previous positions include Deputy CISO for the Federal Reserve System, Chief Business Security Officer at ADP and cybersecurity leadership roles at Equifax. Before joining Equifax, he held positions in information security, compliance and internal audit at McKesson Corporation, Fifth Third Bank and AT&T. He also holds numerous industry certifications and serves as the Board Secretary of the Retail & Hospitality Information Sharing and Analysis Center.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERM"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERM receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERM's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: A dedicated cybersecurity team lead by a cybersecurity manager oversees the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power. The cybersecurity manager reports to Idaho Power's corporate security senior manager. The cybersecurity team has a range of expertise including architecture, forensics, cloud, incident response, auditing/logging, and software administration, with several industry-recognized certifications among the team, including Certified Information Systems Security Professional and Certified Information Security Manager.

companyName: IDACORP INC

ticker: IDA


text: Our first line of defense includes our CIO and Director, Information Security, who work to ensure that the day-to-day execution of the company's technology and security operations are in alignment with corporate policies and procedures. Our CIO, who reports to our Chief Operating Officer ("COO"), has over two decades of experience managing technology risk. Our Director, Information Security, who dually reports to the COO and CIO, has over a decade of information security management experience and as a Certified Information Systems Security Professional. Collectively, they are also responsible for information security policies, organizational readiness and the escalation of certain cybersecurity incidents from our cybersecurity personnel to senior management based on our incident response procedures.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Security Measures: The Company has implemented various security measures like firewalls, encryption, intrusion detections systems, and access controls to mitigate potential risks. Further, the Company also regularly updates software and security protocols to stay ahead of any emerging threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Chief Financial Officer. Our Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: The Compliance Subcommittee is comprised of two of our independent directors, Dr. Raluca Dinu, who serves as its Chair, and Mark Guinan, who serves as a member of the Compliance Subcommittee and also serves as Chairman of the Audit Committee. Each of Dr. Dinu and Mr. Guinan has served in various board and executive roles with risk oversight at public and private companies, each hold undergraduate and graduate degrees in their respective fields, and collectively they have over 23 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: UpHealth, Inc.


text: Our CCO is primarily responsible for assessing and managing our material risks from cybersecurity threats, in close coordination with our Senior Vice President, Operations and IT, and the senior executive leaders of our Video and Broadband business segments. Our CCO's cybersecurity experience includes overseeing the design and implementation of cybersecurity measures and safeguards for Harmonic's Video business software and SaaS offerings as the former long-serving Chief Technology Officer of the Video business, and responsibility at a previous company for the cybersecurity architecture and implementation of an online banking platform and an online transaction processing system for gaming.

companyName: HARMONIC INC.

ticker: HLIT


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall enterprise risk management processes and consider principles from recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity incidents when they occur.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Our Head of Global Supply Chain and IT, Head of Digital Business Services, and Head of Information Security serve on our Cybersecurity Steering Committee (the "Cyber SteCo"), along with our General Counsel who reports to our Chief Executive Officer, and our Head of Financial Processes who reports to our Chief Financial Officer. The Cyber SteCo, which meets monthly, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, and receives regular updates on cybersecurity-related matters.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: In fiscal year 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: At the management level, the ERM Committee, CRO, COO, CSO, Chief Information and Technology Officer, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.

companyName: S&T BANCORP INC

ticker: STBA


text: The vCISO and the Information Security Officer directly report to the General Counsel and CRO. The vCISO, CRO, the SVP, Information Technology, and Information Security Officer meet regularly to discuss both internal and external cybersecurity risks and incidents. The CRO, the SVP, Information Technology and the Information Security Officer also regularly meet with the CEO to update him on any cybersecurity risks and incidents affecting us. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Rhinebeck Bank. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: The Information Security Team advises the CIO via cyber reports on prevention, detection, mitigation, and remediation of cyber security incidents. The CIO is responsible for the Information Security Team risk strategy, assessment, exceptions, risk acceptance, and management of the Company's material risks from cyber security risk appetites. Ongoing assessments cover applicable information technology and operations technology systems, applications, and software used to support Noble's corporate and rig operations. The outcome of these various assessments influences the IT risk appetite and risk identification, and acceptance is discussed and shared with the CIO, executive management, the Audit Committee, and the Board of Directors.

companyName: Noble Corp plc

ticker: NE


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of the Company's cybersecurity risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Company's Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: We also utilize external partnerships to help protect the Company from cybersecurity threats. This combination of people, processes and technology assist us to proactively manage and mitigate threats to our information technology environment. We have controls in place to defend against risks associated with cyber-attacks impacting our operations, compliance and financial reporting objectives. We are externally audited and certified under the ISO 27001 and assessed yearly according to National Institute of Standards and Technology ("NIST") guidelines. Our external partners also evaluate our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Engagement of Third Parties The Company engages third parties in connection with assessing, identifying and managing its cybersecurity risks, including the following: • Engagement of an independent third party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist the Company with preparing for, preventing, investigating, responding to and remediating cybersecurity incidents, including attacks that target on-premise, cloud, and critical infrastructure environments. • Engagement of an independent third party to conduct an annual security program assessment of the controls, maturity and performance of the Company's information security program and the information security risk associated with the Company's business systems. The assessment uses the National Institute of Standards and Technology Cybersecurity Framework as its benchmark. • Engagement of a leading third-party service provider to annually perform an external and an internal penetration assessment using industry standard tools and techniques. Additionally, our Internal Audit team conducts annual assessments of our cyber programs and controls.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors' oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Olo's IRP is also designed to escalate certain cybersecurity incidents to members of management, depending on the circumstances. Our internal security team, among others, works with our CSIRT to help assess, mitigate, and remediate cybersecurity incidents of which they are notified. Our CLO, as the CSIRT leader, directs and coordinates CSIRT's activities, in consultation with the CISO and other members of management. In addition, the IRP includes processes for reporting to the audit committee and our Board of Directors certain cybersecurity incidents.

companyName: Olo Inc.


text: Cybersecurity Incidents As of the reporting period, the Company has not experienced any material cybersecurity incidents that have had a significant impact on operations, data integrity, or financial performance. However, the Company continuously monitors and evaluates cybersecurity threats, including those affecting third -party service providers. While some third -party vendors have reported cybersecurity events, none have materially impacted the Company's systems, computing environments, or customer data. The Company remains committed to enhancing its cybersecurity defenses through ongoing risk assessments, investment in technology, and adherence to industry best practices.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Role of Management, Our Security Risk Committee ("SRC"), comprised of our Chief Security Officer ("CSO"), our Chief Legal Officer and representatives from the technology and product, people, IT and legal teams, is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our CSO works with the SRC to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.

companyName: N-able, Inc.

ticker: NABL


text: Board Oversight of Cybersecurity Threats The Board has oversight responsibility for the Company's overall risk management framework. The Board, acting primarily through the Audit Committee, is also responsible for oversight of our risk management practices, including as to cybersecurity, while management is responsible for the day-to-day risk management processes. Through our Chief Executive Officer and other members of management, the Board receives periodic reports regarding the risks facing the Company, including as to cybersecurity risks. In addition, the Audit Committee assists the Board in its oversight role by receiving periodic reports regarding our risk and control environment, including by receiving regular reports regarding cybersecurity risks and initiatives.

companyName: Liquidia Corp

ticker: LQDA


text: As detailed in Item 1A "Risk Factors - Risks Related to the Use of Technology", third-party technology relationships pose a risk to the organization. As such, third-party risk management processes are aligned with regulatory requirements and are another key focus area within the bank's enterprise risk management framework. Wesbanco employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Wesbanco's sensitive information, systems or networks. This process is also intended to provide for the security and integrity of Wesbanco's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Wesbanco's information assets and reducing the overall risk of cyber threats. Third-party providers are evaluated during onboarding and throughout the ongoing relationship based on the level of risk that the service being provided presents to the organization. The evaluation process includes a thorough review of operational practices related to cybersecurity and considers factors that impact the protection of bank and customer data.

companyName: WESBANCO INC

ticker: WSBC


text: The Information Security Department of the Corporation is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Chief Information Security Officer (the "CISO") who reports directly to the Corporation's Chief Risk Officer. The CISO has over 40 years of combined experience in all aspects of information technology ("IT") from field support to software development to management. Prior to joining the Corporation, the CISO has held management roles of increasing responsibility in a variety of regulated industries including food, pharma, and manufacturing. The CISO holds a Bachelor of Science Degree in Computer Science and has earned a certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The CISO also oversees the Corporation's Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Corporation and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration, business continuity/ disaster recovery testing, and incident response plan testing. The CISO is a member of various management committees, chairs the Corporation's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a quarterly basis to the Corporation's Enterprise-Wide Risk Management Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer of the Corporation, as well independent members of the Board of Directors.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: We are in the process of expanding our policies and procedures to better align with recognized security standards and improve documentation of our cybersecurity framework. We acknowledge that, given our size and available resources, the maturity of our program may be more limited than that of larger organizations.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Our Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Allakos Inc.


text: Cybersecurity risk management is an important part of the Company's overall enterprise risk management systems and processes. Canoo utilizes industry standard cybersecurity frameworks including NIST CSF and ISO 27001 as part of our overall cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Canoo Inc.

ticker: GOEVQ


text: The information security program's ultimate goal is preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of an identified cybersecurity incident, we have developed a detailed cybersecurity incident response process, which outlines the steps to be followed from incident detection, analysis, containment, eradication, recovery, and notification, including notifying functional areas (e.g. information technology, legal, finance, operations, privacy), as well as senior leadership and the Audit Committee, as appropriate. For critical cybersecurity incidents, processes have been established for our legal team to determine the materiality of each incident.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Within the principal functions of the Risk Committee are its responsibilities in overseeing cybersecurity risk, information security, and technology risk, as a well as management's actions to identify, assess, mitigate, and remediate material issues. On a quarterly basis, our Executive Vice President of Technology provides information to our President and Chief Financial Officer, who reports to our Chief Executive Officer and the Risk Committee on our cybersecurity risk capabilities and threats.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, borrowers, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: We utilize an enterprise-wide risk management process to identify, assess, track and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber, technology, and third-party risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting processes and tools. Our team uses widely adopted methods and models to identify, evaluate, prioritize, and manage cyber and technology risks and develop and implement related information security safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other business resilience exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with industry-recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical safeguards and address a wide range of current cyber threats, including from third-party service providers. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: On an ongoing basis, we assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems and security maturity assessments of our corporate and operational networks. We maintain a training program to help our personnel identify and assist in mitigating cybersecurity and data security risks. Our employees and Board members participate in annual training, user awareness campaigns and additional issue-specific training as needed. We also provide annual training for certain contractors who have access to our information technology networks.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO. The CTO has a over two decades of information technology and cybersecurity leadership experience.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our cybersecurity risk management is integrated into our business continuity program and enterprise risk management framework, which promotes proactive planning and preparedness to address potential threats. Members of our global information security team collaborate with subject matter experts within our organization to assess and refine our cybersecurity posture and incident response and preparedness, including evaluating and updating contingency plans, participating in tabletop exercises, threat hunting, red team engagements, and simulating real-world scenarios related to cyber incidents.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: The Company maintains a Cybersecurity Incident Response Plan (CIRP) providing a framework for identifying, evaluating and escalating potential or actual cybersecurity events. The CIRP assigns responsibilities and provides a workflow between the Company's IT security department; the Company's Technology Committee; and the board of directors regarding the detection, assessment and response to a cybersecurity event.

companyName: RLI CORP

ticker: RLI


text: The Company's governance structure is designed to identify, escalate, and mitigate information security risks. Management utilizes its Enterprise Risk Management Committee and IT Steering Committee, comprised of senior leaders including the Company's CRO, CTO, Chief Financial Officer, and other leaders with cybersecurity expertise, to disseminate information and monitor information security efforts throughout the Company. Each committee's charter, in addition to the Information Security Policy, establishes roles and responsibilities related the Company's cybersecurity governance and program. The risk team provides oversight of the Company's activities designed to identify, assess, measure, and mitigate cybersecurity risk. The Company's Information Security Program includes training that reinforces the Company's Information Security Program policies, standards, and practices, as well as the expectation employees comply with these policies. The technology team engages employees through training on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all employees, and is supplemented by various testing initiatives, including social engineering testing. Finally, the Company provides specialized security training for certain employee roles such as system administrators and all information security training is monitored and reported on by the risk team as well as the Company's learning and development function.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: Employee training and awareness programs: Educating employees on cybersecurity best practices and conducting phishing simulations to promote vigilance against social engineering attacks.

companyName: cbdMD, Inc.

ticker: YCBD


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and the audit committee of our board of directors oversees management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.

companyName: Identiv, Inc.

ticker: INVE


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance that will be needed to prepare, detect, analyze, remediate and recover business operations quickly and with the least impact to the Company and its customers.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Cyber Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader information security policy, which is informed by industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and Center for Internet Security (CIS) benchmarks.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Education and Awareness We provide periodic cybersecurity training for all officers and employees as well as periodic additional training for senior management through our cyber insurance carrier.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Index to Financial Statements Information Technology and our Senior Director of Information Security. The topics reported by the Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats to us, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology, information security and engineering for over 14 years and within Mueller for four years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information technology and information security within Mueller for over 20 years.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Overview and Leadership The Company maintains a company-wide risk management system focused on detecting, identifying, defending against and mitigating the impact of cybersecurity risks in order to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors (the "Board") is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: We use these risk assessments to design, implement, and maintain appropriate safeguards intended to mitigate identified risks, address any shortcomings in our existing safeguards, and regularly check how well our safeguards work. Our information technology ("IT") department is primarily responsible for evaluating, overseeing, and handling our cybersecurity risks to manage the risk assessment and mitigation process.

companyName: Global Clean Energy Holdings, Inc.


text: As part of their oversight responsibilities, the Audit Committee and the Compliance and Quality Committee monitor privacy, data and cyber security as specific risk areas. Both Mr. Schechter, a member of the Audit Committee and the Compliance and Quality Committee, and Ms. Schoppert, a member of the Audit Committee and the Compliance and Quality Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.

companyName: DAVITA INC.

ticker: DVA


text: Our board of directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the board in their oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a quarterly basis and more frequently as determined to be necessary or advisable, and the full board receives a cybersecurity program update at least annually. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the board at least annually. Finally, in the event a material cybersecurity incident were to occur, the CAO and Vice President of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: Like other major corporations, DuPont is the target of cyber-attacks from time to time. However, risks from previous cybersecurity incidents, have not materially affected the Company, including its strategy, results of operations or financial condition. For additional information about risks related to cybersecurity, see "The Company's business, results of operations, financial condition and cash flows could be adversely affected by interruption of the Company's information technology or network systems and other business disruptions" in Item 1A. Risk Factors of this Annual Report.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: Accordingly, we have long devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: • an internal information security team that is responsible for conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; • continuous monitoring tools that can detect and help respond to cybersecurity threats in real-time; • performing due diligence with respect to our third-party service providers, including their cybersecurity practices, and requiring contractual commitments from our service providers to take certain cybersecurity measures; • third-party information security and cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and • ongoing cybersecurity training and phishing testing for our employees.

companyName: LAKELAND FINANCIAL CORP

ticker: LKFN


text: Our Board considers cybersecurity risk as critical to the enterprise and is responsible for reviewing our cybersecurity risk profile, including management's design, implementation and enforcement of our cybersecurity risk management program. The Board of Directors receive periodic updates and presentations on cybersecurity topics from our CISO, supported by internal security staff and/or external experts, as part of the Board's continuing education on topics that impact public companies.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: The Cybersecurity Incident affected certain of our information technology systems, and as part of the containment effort, we suspended affected systems and elected to temporarily suspend additional systems in an abundance of caution. We reactivated and restored our operational systems over the course of the week following the Cybersecurity Incident. The Cybersecurity Incident related costs net of an expected insurance receivable totaled $1.0 million. Our system remediation efforts regarding the Cybersecurity Incident have substantially concluded as of December 30, 2023.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: As part of its risk oversight function, the Audit Committee of the Company's Board of Directors is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. These reports include semi-annual cybersecurity updates from the Company's Chief Information Officer and quarterly reports from the Company's risk management personnel on the progress of the Company's broader Enterprise Risk Management ("ERM") risk mitigation activities. As part of the ERM process, the Audit Committee provides input on key risks for the Company to consider. In addition, the Board also provides quarterly input on its views regarding potential emerging risk areas for the Company. The Audit Committee then reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.

companyName: OMNICELL, INC.

ticker: OMCL


text: Assessment, Identification and Management of Material Risks from Cybersecurity Threats As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. We, in conjunction with our Manager, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats which prioritizes detection and analysis of and response to known, anticipated, or unexpected threats, effective management of security risks and resilience against cyber incidents. The Manager's cybersecurity program is aligned to the National Institute of Standards of Technology (NIST) Cybersecurity Framework. Our Manager's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risk from cybersecurity. Our Manager has implemented and continues to implement procedures to address internal and external threats to the security, confidentiality, integrity and availability of our and our Manager's data and systems along with other material risks to operations and information of our shareholders and other third parties who entrust us with their sensitive information.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee and management's Technology Steering Committee are responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: MACROGENICS INC

ticker: MGNX


text: Our information technology team, which has overall responsibility for cybersecurity, is led by our Vice President, Global IT, who, has a Masters Degree in Philosophy, Politics and Economics from Oxford University and 32 years of experience in information technology management, and who reports to our Senior Vice President and CFO. Our cybersecurity management team draws from expertise in our information technology, information security, finance, legal, impacted product teams or product management personnel and other departments as needed. This team is responsible for assessing and managing our material risks from cybersecurity threats and our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants.

companyName: Airspan Networks Holdings Inc.


text: Management of Third-Party Risks We manage third-party risks from vendors and service providers by requiring that providers comply with our cybersecurity requirements and employ appropriate security controls in accordance with local, state and Federal laws. We evaluate applicable security controls of vendors and providers prior to contracting and at least annually thereafter. We evaluate the impact of any control deficiencies or exceptions identified during the review process and consider the effectiveness of the service provider's remediation plans and their commitment to addressing identified issues when determining continued engagement with the service provider.

companyName: Loar Holdings Inc.

ticker: LOAR


text: Our cybersecurity risk management and strategy processes are overseen by our Information Technology team. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the audit committee on any appropriate items. The audit committee holds quarterly meetings and receives periodic reports from management, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Rocket Companies. However, there is no guarantee that we will not be subject to future threats or incidents. We deploy a monitoring program to detect potential threats and keep an incident response plan in place to respond if a security incident occurs. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Rocket Companies, Inc.

ticker: RKT


text: As mentioned above, the CFO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team ("CRT"), comprised of the CFO, Manager of Information Technology ("MIT") and other personnel, as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CFO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College. Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network security, user and email administration, data governance, threat management, and endpoint security.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Cybersecurity threats have not significantly impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, the preventive measures we adopt may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of artificial intelligence ("AI") technologies, and the potential challenges in implementing timely preventive measures.

companyName: Appsoft Technologies, Inc.

ticker: ASFT