text: While we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See Item 1A. "Risk Factors" for more information on our cybersecurity-related risks.

companyName: Fluent, Inc.

ticker: FLNT


text: As part of our cybersecurity risk management system, our information security team tracks and logs privacy and security incidents across our Company, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group including legal, SEC regulation and information security professionals to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Proto Labs Inc

ticker: PRLB

secItem: Item 1C


text: The Rocket Companies Vendor Risk Management Program performs initial and ongoing information security safeguards of our third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.

companyName: Rocket Companies, Inc.

ticker: RKT


text: The operation, integrity and security of our systems and the security of our data and the data of our members, guests and employees is critical to us. We have therefore developed and maintain a cybersecurity program designed to safeguard our systems from unauthorized access and to protect the confidentiality, integrity and availability of our data and the data of our members, guests and employees from external and internal threats.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: Frontier's management is primarily responsible for governing and overseeing cybersecurity risks. Operational responsibility for ensuring the adequacy and effectiveness of the Company's cybersecurity risk management, control and governance processes is assigned to the SVP, Cyber Security (CISO). Our CISO has over 20 years of experience in IT, cyber security and data privacy and data management and reports directly to the EVP, Chief Data and Information Officer (CDIO). Our CDIO has over 25 years of experience, having previously held senior leadership positions in technology, IT and operations at large public companies prior to joining Frontier.

companyName: Frontier Communications Parent, Inc.


text: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: In fiscal year 2024, the Company engaged a consultant to conduct a cybersecurity risk assessment of our business operations at Live Ventures and each of our subsidiaries. This assessment evaluated both internal and external threats to operations and information handling. The output of this assessment offered a structured approach to understanding, assessing, and prioritizing our cybersecurity efforts. In collaboration with the Audit Committee, management will prioritize and implement appropriate measures.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "We have been and may in the future be subject to information technology failures, including security breaches, cyber-attacks, design defects or system failures, that could disrupt our operations, damage our reputation and adversely affect our business, operations, and financial results," "We are subject to governmental laws, regulations and other legal obligations related to privacy, data protection, and cybersecurity," and "We face risks related to security vulnerabilities in our products."

companyName: MAXLINEAR, INC

ticker: MXL


text: We have established and maintain comprehensive incident response and business continuity plans that address our response to, and mitigation and remediation of, a cybersecurity incident, which includes the support of external cyber-specialist resources when deemed necessary, in addition to managed services to support our Security Operations Center function. We have implemented controls and procedures that provide for the prompt escalation of cybersecurity incidents to the ELT, and the Board of Directors when appropriate, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: nVent Electric plc

ticker: NVT


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 5 years. He has over 38 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.

companyName: AEye, Inc.

ticker: LIDR


text: Management, together with third-party information security service providers, is responsible for assessing material cybersecurity risks on an ongoing basis, ensuring processes are established to monitor and respond to such potential cybersecurity risks, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our CTO, who receives reports from our third-party information security service providers and technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as well as resource levels, technology trends and third-party provider risks. Our CTO and technology team are experienced information systems security professionals and information security managers with many years of experience. Management, including the CTO and our technology team, periodically update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: We rely on information systems and the data stored on them to conduct our operations. We have adopted and maintain a cybersecurity risk management program, as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business. Our cybersecurity risk management program has been informed by industry standards, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: KULICKE & SOFFA INDUSTRIES INC

ticker: KLIC


text: PGE engages a third party to attempt to penetrate its systems periodically. These assessments support a continuous improvement initiative, ensuring ongoing enhancements to security posture. As a NERC registered entity, PGE is audited triennially by WECC on cybersecurity practices. The most recent audit concluded in 2023.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: We use, store and process data for and about our customers and employees. W e have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems. We did not experience any cybersecurity incidents in 2024 that materially affected the Company.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Our Board of Directors is actively involved in overseeing risks from cybersecurity threats and is assisted in that oversight by its Risk Committee. The Risk Committee reviews and assesses the Company's cybersecurity risk exposure and evaluates the adequacy and effectiveness of related risk management processes and policies.

companyName: F5, INC.

ticker: FFIV


text: Risks to our Business As a global data, analytics and technology company, our products and services involve the storage and transmission of personal information of consumers. As a result, we are routinely the target of attempted cyber and other security threats presented by outside third parties, as well as security threats presented by employees and other insiders.

companyName: EQUIFAX INC

ticker: EFX


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems.

companyName: Azitra, Inc.

ticker: AZTR


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We have established a third-party risk management program that includes a formal vendor and cloud security policy and processes to conduct diligence on applicable vendors, including the use of questionnaires and obtaining additional security documentation. Cybersecurity controls language may be included in third-party service provider contracts, and if applicable, this language is designed to be tailored to the use case and sensitivity of any data or business processes involved.

companyName: Keenova Therapeutics plc


text: Conclusion. Our Board of Directors and management take very seriously the information security and cybersecurity obligations that Magnolia Bancorp and Mutual Savings and Loan Association have to their respective customers, shareholders, staff members and regulatory agencies. In support of these obligations, we have and actively maintain a robust information security and cybersecurity program based upon industry best practices, regulatory requirements, and the expertise of staff members and supporting third-party vendors.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: The Information Technology/Information Security Steering Committee (the "IT Steering Committee") reports directly into the ERMC and meets at least quarterly. The IT Steering Committee is composed of senior members of management, including the CDO, the CRO and the CISO. The IT Steering Committee oversees information technology matters at the Company, including the implementation of all cybersecurity policies, standards, guidelines and procedures. The responsibilities of the IT Steering Committee include, among other things, updating the Company's information technology policies, reviewing the architecture of the Company's information system infrastructure and monitoring the progress of any significant hardware or software updates or installation. In addition, the IT Steering Committee provides quarterly reports to the ERMC and the Risk Committee regarding any information-technology-related matters that, in the opinion of the IT Steering Committee, should be escalated.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: To date, we do not believe that our business, including our business strategy,, results of operations, or financial condition have been materially affected, or are reasonably likely to be materially affected, as a result of identified cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents that we are aware of. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future cybersecurity incidents. For more information on our cybersecurity-related risks, please refer to the risk factor titled "We rely on our digital technology and applications and our business and operations could suffer in the event of information system failures or a cybersecurity incident" in Part I, Item 1A of this Report.

companyName: Evolus, Inc.

ticker: EOLS


text: While we have not had any material cybersecurity breaches to our knowledge in recent years, the CFO is continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and system audits as needed to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: City Office REIT, Inc.


text: Additionally, the Company assesses and manages cybersecurity threats associated with the information technology systems of its third party service providers that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.

companyName: PUBLIX SUPER MARKETS INC


text: The audit committee of our board of directors is responsible for overseeing the implementation of the cybersecurity policies and procedures applicable to us, and related reporting. This includes quarterly reporting to our audit committee as well as ad hoc incident reporting whereby if we are notified of an incident, whether reported to us by Deutsche Bank Group or any of our third-party vendors, we will assess it and advise the audit committee of our board of directors depending on the severity of the incident. The audit committee can, in its discretion and at our expense, retain special legal or other consultants to advise the audit committee or to assist in the conduct of any investigation, subject to our board of directors determination to allocate assets to pay for such investigation.

companyName: RREEF Property Trust, Inc.


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Our Head of Cybersecurity reports to our CFO who reports to our Chief Executive Officer.

companyName: Capri Holdings Ltd

ticker: CPRI


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our cybersecurity risk management and strategy processes are led by our CIO, VP Information Technology, and Manager of Security. Such individuals have collectively over 50 years of work experience in various roles managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, along with all companies of comparable size, we face common cybersecurity threats. These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors. Our customers, supply-chain providers, and subcontractors face similar cybersecurity threats, and an incident impacting us or any of these entities could materially adversely affect our business operations.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: Dana's global cybersecurity team is charged with executing enterprise, product, and manufacturing cybersecurity programs and policies with a focus on security architecture, penetration testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training, and governance. Dana's cybersecurity programs utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverage the International Organization for Standardization (ISO) 27001 standard for information security. Dana periodically contracts with external auditing firms to assess the maturity of Dana's cybersecurity program against the NIST Cybersecurity Framework. The results of these audits are shared with the Technology & Sustainability Committee. Dana leverages independent security ratings services assessments to aid in measuring our progress along the cybersecurity continuum as well as for measurement against peer companies. Dana's supplier risk management process incorporates cybersecurity review and assessment procedures over third-party vendors and service providers.

companyName: DANA Inc

ticker: DAN


text: As noted above under "Risk Management", we maintain an information and cybersecurity risk management program, which is led by our CISO and is designed to protect the confidentiality, integrity and availability of critical information and information systems.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Our cybersecurity program also includes third-party risk management evaluation and monitoring of our suppliers, vendors, and other business partners to help identify and mitigate risks that may impact our company. We evaluate existing risks, threats, and prior cybersecurity incidents of new vendors, suppliers, and business partners using various risk assessments.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: Management Oversight We have a dedicated enterprise security team responsible for assessing and managing our material risks from cybersecurity threats. Our enterprise security team is led by our CISO, Drew Robertson, who has extensive experience in cybersecurity. In addition to acting as our CISO, Mr. Robertson currently advises several companies in the Cyber Security Industry and is active in a number of information security communities and groups. Prior to his appointment as CISO in October 2021, he served as our Deputy CISO. Before joining the Company, Mr. Robertson worked for the National Security Agency and the U.S. Army, where he held various leadership positions in computer network defense, computer network exploitation, and intelligence oversight. Mr. Robertson holds a BA in Organizational Management, an MS in Cybersecurity Policy, and an MBA.

companyName: Finance of America Companies Inc.

ticker: FOA


text: We maintain policies and have established processes involving our cybersecurity, privacy and legal teams that assess potential cybersecurity risks associated with our retention and use of third-party service providers. These policies and procedures are generally aligned with the NIST Cybersecurity Framework. Prior to retaining or renewing a third-party vendor, the Company policy requires a risk assessment of such potential new vendor or new engagement through a collaborative process among the Company's IT security, privacy, insurance and legal teams, among others. Potential vendor engagements also are reviewed to assess a range of other considerations and contractual terms and conditions, including, among other things, a potential vendor's liability insurance limits, scope and coverage of cyber insurance and privacy data protections. Our IT SOX team also conducts annual SOX reviews for those vendors that are considered in scope for SOX controls. All finalized vendor engagements are considered by Internal Audit as part of our ordinary course risk assessment and audit planning.

companyName: DAVITA INC.

ticker: DVA


text: Cybersecurity risk was classified as a Tier 1 enterprise risk for our Company by our Enterprise Risk Committee for 2024. Our Manager Enterprise Risk, with oversight by our Enterprise Risk Committee, facilitates the monitoring of all Tier 1 enterprise risks within our digital work environment for changes in risk drivers and supports the evaluation of the potential impacts of each Tier 1 enterprise risk on our Company, taking into consideration the effectiveness of our identified risk mitigants.

companyName: EQT Corp

ticker: EQT


text: Related to Cybersecurity Risks Our Chief Executive Officer, with the assistance of the Company's third-party information technology providers, is responsible for the strategic leadership and direction of the Company's cybersecurity program.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: In addition to the cybersecurity incident response plan, our outsourced team conducts tabletop exercises to enhance our incident response preparedness. They also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Such processes include conducting due diligence and risk assessment of our current and potential vendors that examine such vendor's cybersecurity protocols and adherence to applicable regulations.

companyName: NEPHROS INC

ticker: NEPH


text: Keith Moss, our Head of Information Technology, oversees our cybersecurity and information security program. He has over 30 years of experience in various CISO and information technology roles, and was previously the IT Director at Ford Motor Company North America. He holds a Master of Science in Computer Engineering and a Bachelor of Science in Computer Science from the University of Michigan and an MBA from Bowling Green State University.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: The Company's cybersecurity program utilizes the National Institute of Standards and Technology Cybersecurity Framework as its foundation. Accordingly, CPKC's program includes periodic risk assessments, penetration testing by a third-party, audit participation, employee and contractor training, and the implementation of technologies to assist in mitigating cybersecurity risks and harms. Incident response procedures, including escalation procedures, are designed, implemented, and periodically tested to assist the Company in detecting, responding to, and recovering from a potential cybersecurity incident, and making any timely notification or disclosure that may be required under the circumstances. The Company scopes the third-party penetration tests as real-world attacks against perimeter defenses and internal processes such as social engineering and phishing.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management and have attended external trainings.

companyName: ESAB Corp

ticker: ESAB


text: The ITW Cybersecurity Framework includes a number of activities designed to enhance the Company's resiliency related to cyber-related risks and ensure that the Company's information systems are secure from material cybersecurity threats. These activities include the following, among others: • Annual cybersecurity training; • Quarterly phish simulation testing; • Ongoing response planning and tabletop exercises; • Network and endpoint monitoring; • Vulnerability management and testing; and • Backup and recovery testing.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Our Information Security Program is aligned with applicable federal and state regulations, the Federal Financial Institutions Examination Council (FFIEC) Examination Guidance, and industry-accepted security standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, which are at the forefront of cybersecurity guidelines for federal agencies in the U.S. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including, but not limited to, advanced anti-malware and firewall technologies, anti-phishing and web filtering controls, robust patch management and vulnerability management processes, configuration hardening, participation with FS-ISAC (Financial Services Information Sharing and Analysis Center) for sharing and consuming threat information, and we perform regular security testing to evaluate our defenses against real-world threats. We have an extensive information security training program that aims to regularly educate our colleagues on current best practices on handling sensitive information and expectations for protecting the organization and our clients. All employees complete mandatory cybersecurity training on at least a quarterly basis, including how to identify phishing attacks. Colleagues are tested regularly with simulated social engineering attacks to ensure awareness and preparedness. As an additional risk mitigation measure, the Bank maintains cybersecurity insurance in the event that a material incident does occur.

companyName: WAFD INC

ticker: WAFD


text: The Company's IT services including, but not limited to, service desk support, endpoint management, network and server administration, cloud engineering, and cybersecurity and incident management, are provided by third-party consultants who are employed on a contract basis. Our IT consultants report directly to the Company's CFO for executive oversight and accountability.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, internal audits of our program, independent external expert evaluations of our program's maturity and operational readiness and the results of penetration testing. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident report and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: BIOGEN INC.

ticker: BIIB


text: Role of Management Our Technology & Security Team, which is led by our Chief Technology Officer ("CTO"), Ivneet Kaur, oversees our cybersecurity program. Ms. Kaur has over 20-years' experience in leading global technology & security teams, including in the financial services and consumer reporting industries. She holds a Masters degree in Engineering Management from the University of College Park, Maryland and a Masters in Software Systems from Kurukshetra University in India. Members of our Technology & Security Team hold industry certifications such as CISSP, Security+, and GIAC.

companyName: Sterling Check Corp.


text: To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. Cybersecurity risks are reviewed at least quarterly by the Enterprise Risk Management and Compliance team and escalated to senior management as appropriate. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.

companyName: TORO CO

ticker: TTC


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "The Company's information technology systems could suffer interruptions, failures or breaches and our business operations could be disrupted adversely effecting results of operations and the Company's reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Vertex Energy Inc.


text: We regularly evaluate the cybersecurity threats associated with third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide third-party vendors, consultants, and partners with detailed security requirements for securing their connections to our IT networks. In addition, we seek to make third-party service providers contractually responsible for identifying and remediating security issues within their technology and service environment.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: Senior information security and technology employees, including the chief information and operations officer, meet regularly to discuss potential information and cybersecurity threats that have been identified by our systems, employees or otherwise made known to us by our third-party service providers, vendors and other external users, and to formulate the appropriate response to any identified material information and cybersecurity threats. When high-priority information or cybersecurity risks are identified, certain employees in our information security, privacy, technology, legal and compliance departments meet or communicate to review potential threats in accordance with our internal cybersecurity incident response process.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Following these risk assessments, we develop strategies, policies, standards, and action plans to minimize identified risks and reasonably address any identified gaps in existing safeguards. These steps include vulnerability management, shift-left secure product design, data encryption, endpoint security, network security, limiting and authorizing access controls, and multi-factor authentication for access to systems with data. We also employ system monitoring, logging, and alerting to retain and analyze the security state of our corporate and production infrastructure. As part of our overall risk management system, all employees are required to complete annual cybersecurity training and relevant employees are trained at least annually on applicable safeguards.

companyName: Marqeta, Inc.

ticker: MQ


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a range of activities, including audits, assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: Axe Compute Inc.

ticker: AGPU


text: We prioritize cybersecurity within our supply chain, both nationally and globally, by assessing our third-party cybersecurity posture to provide secure visibility with our partnerships. As part of our due diligence processes, we conduct security questionnaires and service provider reviews, to align our cybersecurity standards on the onset of our partnerships. Additionally, we collaborate closely with a third-party vendor to enhance supply chain resilience. This collaboration involves leveraging their expertise to inform decision-making and enhance risk oversight processes, ensuring greater robustness, and adaptability in managing supply chain challenges.

companyName: EnerSys

ticker: ENS


text: The ACT, in consultation with the ELT and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our cybersecurity program. The results of this assessment, which are reported to the Board, assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: QXO, Inc.

ticker: QXO


text: Material Cybersecurity Incidents. While we have experienced several security incidents in the past, we have not experienced any material cybersecurity incidents for the fiscal year ended December 31, 2023. We do not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition.

companyName: OneSpan Inc.

ticker: OSPN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan, a vendor risk management program, employee training, data encryption, physical security, dedicated cybersecurity staff, systems monitoring, cyber insurance, and asset management, tracking, and disposal.

companyName: biote Corp.

ticker: BTMD


text: Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator reports to, and meets periodically with, our Director of Operations to discuss and review our information security and cybersecurity risk management processes.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: The governance, risk and compliance division of the Information Security team includes a dedicated information technology ("IT") and Cyber operation risk assessment team. This team conducts assessments that are focused on the company's most significant IT and cyber risks, the results of which are leveraged by IT leadership, among other inputs, to mitigate, reduce and/or manage against such risks. While it is not possible to be certain that all risks, threats and vulnerabilities to our information and systems have been identified, our cybersecurity risk management processes are designed to, using a risk-based approach, identify reasonably known risks from cybersecurity threats and ensure material risks are managed appropriately.

companyName: LINCOLN NATIONAL LIFE INSURANCE CO /IN/


text: We protect our information systems, data, and network through technical and procedural controls and security awareness training. We deploy multiple technical controls to achieve a layered security strategy including systems access controls, firewalls, web application gateways, antivirus software, e-mail filtering, and endpoint protection. Security awareness training is mandatory for all employees and conducted at time of hire and periodically thereafter. The security awareness training program is designed to ensure employees are prepared to identify and avoid cyber risks and may cover topics such as phishing, ransomware, social engineering, public Wi-Fi risks, password security, and mobile device security. Training is supplemented by testing initiatives, including periodic phishing tests, which may result in targeted or remedial training.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: We rely heavily on third party service providers for our clinical development activities and cloud-based documentation and communications. A cybersecurity incident at a vendor or other third-party service provider could have a material and adverse impact on our business, results of operations and financial condition. Third-party vendor cybersecurity risks and procedures are evaluated by our Quality Assurance and Regulatory Department during our prequalification process and during subsequent periodic reviews.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third -party service providers, to effectively identify, assess, and manage cybersecurity risks.

companyName: Whitestone REIT

ticker: WSR


text: Global cybersecurity threats and incidents can pose risks to UEI, impacting data security, operational efficiency, and financial stability. Our business requires collection, processing, and retention of large volumes of Company and sensitive and confidential third party data, including personally identifiable information in various information systems that we maintain and in those maintained by third parties with whom we contract, including in areas such as customer product servicing, human resources outsourcing, website hosting, and various forms of electronic communications. Cybersecurity incidents risk disclosure of sensitive information and disruption of our operations. Financial consequences include recovery costs, fines, and potential legal repercussions. Such incidents could result in losses, severely damage our reputation or expose us to the risks of litigation and liability.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this 2024 10-K Report, including the risk factor captioned "We may not be able to maintain effective and efficient information systems or properly safeguard our information systems." While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: IoT Vulnerabilities: Internet of Things ("IoT") devices used in maritime operations can pose security vulnerabilities if not properly secured, potentially allowing attackers to gain access to critical systems or data.

companyName: International Seaways, Inc.

ticker: INSW


text: In 2023, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: The Company employs multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Employees undergo cybersecurity training during orientation. Employees and board members receive annual training to promote cybersecurity awareness. All employees are required to abide by our cybersecurity and data protection policies. To our knowledge and to date, the Company has not experienced a material cybersecurity incident.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Material cybersecurity risks are addressed by Morgan Stanley management-level ERM committees with escalation to the BOTC and our board of trustees, as appropriate. The BOTC has primary responsibility for assisting the MS Board in its oversight of significant operational risk exposures of Morgan Stanley and its business units, including IT, information security, fraud, third-party oversight, business disruption and resilience, and cybersecurity risks (including review of cybersecurity risks against established risk management methodologies) and the steps management has taken to monitor and control such exposures.

companyName: North Haven Net REIT


text: As of the date of this report, IDACORP and Idaho Power believe that no risks from known cybersecurity incidents have materially affected or are reasonably likely to materially affect IDACORP or Idaho Power, including their business strategy, results of operations, and financial condition. However, the companies can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect the companies, including their business strategy, results of operations, or financial condition. For more information regarding the risks the companies face from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: IDACORP INC

ticker: IDA


text: Cybersecurity risks are continually evolving, becoming increasingly complex and pervasive across all industries. To mitigate these cybersecurity risks and protect nonpublic, personally identifiable customer data, financial transactions and our classified information systems, the Bank has implemented a comprehensive information security program, which is a component of its overarching enterprise risk management program. Key components of the information security program include: • A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors. • Annual security assessments that proactively identify potential vulnerabilities that are both externally facing and internal within the bank's infrastructure; reports the results for all assessments to executive management and the Board of Directors with tracking and resolution to potential areas of risk. • Vulnerability management program that patches known vulnerabilities across operating systems and software platforms. • Strong controls around user access including creation, changes and termination of access, ongoing user access reviews, multifactor authentication and password policies. • A technology team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence. • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks. • An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. • An incident response plan that outlines the steps the Bank will take to respond to a cybersecurity incident, which is tested on a periodic basis. • Adoption and implementation of a layered defense / defense in depth model n which security systems are linked or stacked so that the strengths of one security system compensate the weaknesses of the other system. • Additional controls that include but not limited to data encryption; change management; end of life management; asset management; malware and antivirus detection, response and mitigation; physical security; business continuity and disaster recovery management.

companyName: BCB BANCORP INC

ticker: BCBP


text: The Board recognizes its responsibility to oversee risk management. As part of this responsibility, the Board requires management to perform an overall assessment of risk annually. This enterprise-wide risk management assessment is designed to review and identify potential events that may affect us, including cybersecurity risks, manage risks within our risk profile and provide reasonable assurance regarding the achievement of our objectives. The Audit Committee has the responsibility of reviewing the enterprise-wide risk assessment and discusses with management our major financial risk exposures and the steps management has taken to monitor and control such exposures, including our financial risk assessment and risk management policies.

companyName: DAVEY TREE EXPERT CO


text: Specifically, management implements the Company's cybersecurity and risk management strategy across several areas: • Identification and Reporting. The Company has implemented a robust, cross-functional approach to identifying, assessing and managing cybersecurity threats and risks. The Company's program includes controls and procedures designed to properly identify, classify, and escalate cybersecurity risks to provide management with visibility and prioritization of risk mitigation efforts and to publicly report material cybersecurity incidents if and when appropriate. • Threat Intelligence. The Company maintains a Threat Intelligence team focused on profiling, intelligence collection, and threat analysis supporting the Company's ongoing efforts to identify, assess and manage cybersecurity threats. The team's input supports both near-term response to cybersecurity events, and long-term strategic planning and development of the Company's cybersecurity risk management framework. • Technical Safeguards. The Company implements technical safeguards that are designed to protect both the Company's service offerings and other information systems it controls from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, vulnerability management, encryption processes and access controls, all of which are periodically evaluated and improved through risk and control assessments and in response to cybersecurity threat intelligence as well as outside audits and certifications. • Incident Response and Recovery Planning. The Company has established and maintains robust incident response, business continuity and disaster recovery plans designed to address the Company's response to a cybersecurity incident, including any required public disclosure and reporting of material incidents in a timely manner. These plans and procedures serve to guide and document a rigorous incident response program that reflects the roles of an array of stakeholders, including personnel providing technical, operational, engineering, legal and other perspectives across the Company. The Company conducts regular tabletop exercises involving multiple operational teams, including senior management, to test these plans and to familiarize personnel with their roles in a response scenario. • Third-Party Risk Management. The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity threats presented by certain third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a significant cybersecurity incident affecting those third-party systems. • Education and Awareness. The Company regularly provides employee training on security-related duties and responsibilities, including knowledge about how to recognize security incidents and how to proceed if an actual or suspected incident should occur. This training is mandatory for employees across the Company, and is intended to provide the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: FAIR ISAAC CORP

ticker: FICO


text: Under the leadership of the CIO, the Information Technology Steering Committee ("ITSC") serves to improve the effectiveness of information technology at the Bank and ensure alignment with the Bank's strategic business plan and statement of risk appetite. Composition of the ITSC will consist of senior management from the business areas. Meetings occur at least bi-annually. The ITSC is tasked with reviewing the Bank's technology, information security, business continuity, digital initiatives, vendor management, and data management strategic direction and providing feedback to management.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company's ERM framework. The Information Security Program encompasses the Company's cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents. In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company's information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion. The Information Security Program follows a National Institute of Standards and Technology based Cybersecurity Framework and other applicable industry standards.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: Technology is at the core of our business, with customers, exchanges, clearing houses, counterparties, and third-party service providers interacting with our systems and applications on an ongoing basis. As a consequence, we are subject to significant cybersecurity risks. Moreover, such risks have been increasing over time, due to the growing sophistication of cyber threat actors, geo-political instability, and advances in technology, such as AI, which are known to have been misused in cyber-attacks.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Alphabet Inc. management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Alphabet's independent public accounting firm of matters and any relevant developments.

companyName: Alphabet Inc.

ticker: GOOGL


text: Signet's cybersecurity program is run by our CISO, who is the head of the Company's cybersecurity team, and who reports to Signet's Chief Information Officer ("CIO"). The CISO is responsible for assessing and managing Signet's cybersecurity risk management program, regularly informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position with Signet since 2018, was previously CISO at multiple Fortune 500 retail and hospitality organizations, and held senior cybersecurity management roles in the financial services industry. The Signet cybersecurity team supporting the CISO has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Signet. In addition, a cross-functional management committee has been established to assess cybersecurity breaches, should they occur, to determine whether a breach is material and requires disclosure.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology. In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking. The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.

companyName: Phillips 66

ticker: PSX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trial and development of therapeutic proteins and antibodies ("Information Systems and Data").

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit Committee. The Audit Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of information technology operations, including cybersecurity risks and information security. The Director of Information Technology reports to the Audit Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, engaging through regular and requested updates on our strategy and evolving threat landscape.

companyName: BROADWIND, INC.

ticker: BWEN


text: The Company's Risk Management Guidelines also dictate that the Board will conduct an annual performance evaluation of the Board's oversight of the Company's overall risk-taking tolerance and management, conducted in such manner as the Board deems appropriate.

companyName: Verano Holdings Corp.

ticker: VRNO


text: As of the date of this Annual Report on Form 10-K, we have not identified of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer ("CISO") on cybersecurity risks, industry trends, and best practices.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: We have implemented a cyber incident response standard operating procedure (the "SOP") detailing actions to be taken in the event of a cyber incident. Pursuant to the SOP, any suspected cyber breaches or detected vulnerabilities are promptly reported by our cybersecurity team to our Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO") for further assessment and/or remediation. In addition, we require our employees to regularly participate in mandatory cybersecurity training that covers critical aspects of digital security, including phishing prevention, threat awareness, and safe data handling practices. Cybersecurity risk considerations are also incorporated into our broader business continuity planning. In addition to our internal processes, our partnerships with various third-party vendors comprise a key component of our cyber risk management program. We engage several reputable third-party companies to monitor and work to maintain the performance and effectiveness of our products and services, as well as to conduct System and Organization Controls (SOC) assessments and our mandatory cybersecurity training for employees. We are also implementing systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

companyName: STEM, INC.

ticker: STEM


text: The Audit Committee receives, and reviews reports on our risk management processes, which include assessments of management's cybersecurity threats and incident management functions. The committee receives periodic reporting of certain cybersecurity risks from the Chief Information Security Officer, including reports related to social engineering, effectiveness of cyber security training, as well as vulnerability and penetration assessments performed on the Company's information systems by internal and by external parties and audit reports of information systems and cybersecurity threat and incident monitoring.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: We conduct quarterly risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers.

companyName: MAXLINEAR, INC

ticker: MXL


text: We have not experienced any cybersecurity incidents that have been determined to affect us materially, our business strategy, results of operations, or financial condition. As external events evolve, we will continue to evaluate and address these conditions as needed.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: above. Under such policies and processes, our Chief Financial Officer is responsible for reporting to our Board of Directors regarding any cybersecurity incidents.

companyName: Bone Biologics Corp

ticker: BBLG


text: Conducting regular cybersecurity training for our employees regarding security awareness, the proper use and handling of sensitive information, and the protocols in place to identify, assess, and manage any cybersecurity threats and periodically testing employees' cybersecurity knowledge, policy compliance, and response rates by engaging with third-party providers to conduct internal social engineering campaigns;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors. We maintain an incident response and a disaster recovery plan, which includes plans around managing cybersecurity incidents, and is intended to serve as a guide for management of such events and to set forth communication procedures regarding potential impacts to our board, investors, and other stakeholders, as appropriate.

companyName: MYOMO, INC.

ticker: MYO


text: P otential cybersecurity incidents are reviewed by the Chief Information Security Officer and the Information Technology Steering Committee. The evaluation of reported events by the committee includes reporting of any mitigation or remediation determined necessary to address the threat posed by the reported event. If any event rose to the level of a material incident, management maintains an incident response plan to mitigate the impact, maintain business continuity and provide for internal and external communication, including required notifications.


text: Our Information Security Program requires that employees adhere to our Third Party Information Security Policy, as well as the Third Party Risk Management Policy, which requires review of third-party controls to determine whether such controls meet the objectives of our Third Party Information Security Policy. The ORO team is responsible for overseeing that appropriate information security risks are identified and monitored. We rely on many third-party service providers and network participants, including merchants, and, as such, a security breach or cyber attack affecting one of these third parties could impact us.

companyName: Discover Financial Services


text: The Board has delegated to its Audit and Finance Committee the responsibility for overseeing cybersecurity risk exposures in addition to our broader risk management program. Management (including the Chief Information Officer ("CIO") and the CISO) reports at least annually to the Audit and Finance Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster security systems and the cyber readiness of personnel.

companyName: EASTMAN KODAK CO

ticker: KODK


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over two decades of cyber security experience in a variety of industries including banking, aerospace, manufacturing and defense. A decade of this experience has been in senior leadership roles. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.

companyName: GXO Logistics, Inc.

ticker: GXO


text: The Company also maintains a Security Incident Response Team (SIRT) that responds to high-risk security incidents on a 24-hour basis. Members of this team include representatives of our CSOC and Networking Operations Center, as well as cloud/server engineering, network engineering, enterprise data, identity and access management, GRC, end-user computing, application development, and IT leadership teams.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, see "Risk Factors—Risks Related to Our Business—If our security measures are compromised now or in the future, or the security, confidentiality, integrity, or availability of our information technology, software, services, communications, or data is compromised, limited, or fails, this could have a material adverse effect on our business, financial condition, and results of operations."

companyName: Doximity, Inc.

ticker: DOCS


text: Management under the CIDO is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential risk exposures are monitored, implementing appropriate mitigation measures and maintaining cybersecurity programs. The CIDO and cybersecurity team members are certified and/or experienced information systems security professionals and information security managers with many years of experience.

companyName: HNI CORP

ticker: HNI


text: Cyber Risk Management and Strategy Under the oversight of our Audit Committee, we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process. We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We intend to utilize well-known cloud-based technologies and service providers, such as Amazon AWS, Microsoft Office, and Google enterprise to provide protection against cybersecurity threats.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: As part of our annual enterprise risk assessment, cybersecurity risks are ranked and reviewed by executive management. In the event of a cybersecurity incident, the Vice President of Information Technology, in collaboration with our cybersecurity partners, would conduct a comprehensive impact assessment. This assessment would outline both potential and actual risks, along with necessary remediation steps. If an incident is deemed material, the Vice President would escalate the matter to the Board of Directors, who would determine whether disclosure to customers or investors is required.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We engage assessors, consultants, and auditors in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Due to the size and scope of our global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: Management for certain operational and IT services. To mitigate risks associated with these partnerships, we implement a vendor risk management program that includes: Due diligence reviews of vendors' cybersecurity policies and practices prior to engagement. Contractual requirements for vendors to maintain robust security controls and report incidents promptly.

companyName: Quality Industrial Corp.

ticker: QIND


text: Company engages two external cybersecurity and information technology consultants to work with the Company, including the general counsel, to help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's information security risk register. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, and conducting third-party threat assessments.

companyName: GENELUX Corp

ticker: GNLX


text: We have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive, confidential and personal data. These processes are implemented and overseen primarily by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO). Our CIO has over 35 years of experience and in his 20 years at NVR has been responsible for the implementation and modernization of many of our key technologies across the enterprise. Our CISO has over 25 years of experience in information technology architecture, including over 18 years with NVR in progressively more senior information security roles.

companyName: NVR INC

ticker: NVR


text: To manage our material risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • monitor emerging data protection laws and implement changes to our processes to comply; • conduct periodic data handling and use requirement training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • conduct regular phishing email simulations for all employees.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook and Cyber Assessment Tool, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: SLM Corp

ticker: SLM


text: The Company monitors industry events and leverages additional resources to monitor any new threats and vulnerability information. Systemic prevention controls are deployed to protect endpoints, as well as to prevent malicious code, emails, and websites from attempts to gain access to the network. Company personnel are trained on a recurring basis on best practices to protect the Company from cybersecurity risks. The Company's assets are subject to recovery procedures to bring the asset back to its required state of operations, and these recovery procedures are tested internally by the Company to verify the capabilities of these procedures. The Company has developed an Incident Response Policy and Plan that assigns appropriate responsibilities in the event of an incident. This assignment of responsibilities allows the Company to assess and respond to any incident in a timely manner. This plan is tested on a recurring basis to maintain preparedness in the event of an actual incident.

companyName: EVANS BANCORP INC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Executive Officer.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We regularly evaluate cybersecurity risks from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are monitored and reviewed by management on a periodic basis as deemed appropriate.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: We have designed and implemented an information security program that is tailored to our operations and infrastructure, the nature of our products and services, and the sensitivity of data. Our information security program consists of processes that are designed to identify, assess, and manage material risks from cybersecurity threats.

companyName: Zoom Communications, Inc.

ticker: ZM


text: Our CISO oversees an internal cross-functional information technology governance, risk, and compliance team that actively maintains a register of risks and mitigation measures under the umbrella of our enterprise risk management program. Our enterprise risk management program is designed to identify and monitor risks to the Company, assess the Company's risk mitigation plans, and consult on further measures that can be taken to address new and existing risks. Our Enterprise Risk Management Committee, which meets quarterly, is comprised of our executive officers, Senior Vice President of Information Technologies and Engineering, CISO, Chief Accounting Officer, Vice President of Internal Audit, Corporate Secretary, and Director – Risk Management & Insurance. Our Risk Management and Insurance Department is responsible for the implementation of our enterprise risk management program and maintains a register of risks and initiates reviews and assessments. The Director of Risk Management and Insurance reports to the Audit Committee and full Board on a quarterly basis.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third -party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including incident detection and response, a vulnerability management policy, business continuity plans, risk assessments, encryption of certain data, access controls, employee training, penetration testing, cybersecurity insurance, systems monitoring and dedicated cybersecurity staff.

companyName: Xometry, Inc.

ticker: XMTR


text: In the event of a cybersecurity incident, we maintain a regularly tested incident response program, including response programs specifically designed for common threats. Pursuant to our escalation protocols, designated personnel, including our CISO and VPAA, along with appropriate members of our management and executive team, are responsible for assessing the severity/priority of a cybersecurity incident and associated threat, containing the threat, and remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Poseida Therapeutics, Inc.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats could pose multiple risks to us. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.

companyName: Humacyte, Inc.

ticker: HUMA


text: Dow's Chief Information and Digital Officer has formal education in information technology and more than 30 years of experience in information systems and technology, including as the vice president of Global Information Technology. Prior to joining Dow, the Chief Information and Digital Officer held a variety of leadership roles including vice president of Information Technology at Cargill, Incorporated. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: UNION CARBIDE CORP /NEW/


text: We have an incident response plan designed to help us monitor the prevention, detection, mitigation, and remediation of information security incidents. The incident response plan documents the roles and responsibilities of Primerica personnel in responding to information security incidents, including the process by which the Chief Information Security Officer, the Chief Information Officer, senior management, and the Board is informed about such incidents.

companyName: Primerica, Inc.

ticker: PRI


text: We have implemented and maintain an ongoing cybersecurity risk management program, under the oversight of the audit committee of the board of directors, that is focused on identifying, assessing and mitigating cyber risk. We engage with multiple third-party vendors who provide a variety of services ranging from ongoing security advisory services to security monitoring and response management. In addition, we also have a process to assess and review the cybersecurity practices of third-party vendors and service providers, including through the use of vendor questionnaires and contractual security requirements, as appropriate. In addition to these efforts, we have implemented an ongoing enterprise risk management program that includes processes designed to identify, assess, and address cybersecurity risks. Our cybersecurity efforts are informed by industry standards and include periodic, targeted risk assessments supported by cybersecurity technologies, including third-party security solutions and monitoring tools, designed to monitor, identify, and address cybersecurity risks.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Trends, Risks and Uncertainties Related to Technology and Data Privacy" in this Form 10-K.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Board Reporting. On a quarterly basis, the CISO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program, including the Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: The SVP of Information Technology also presents at least annually to the Board an overview of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results of third-party assessments, our incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: The IT Steering Committee and the full Board actively participate in discussions with management regarding cybersecurity risks. The IT Steering Committee performs an annual review of the Corporation's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The IT Steering Committee's annual review also includes review of recent enhancements to the Corporation's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Corporation is managing those threats. Further, at least annually, the Board receives updates on the Corporation's Incident Response Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.

companyName: Meridian Corp

ticker: MRBK


text: Members of senior management are notified by our Information Security Committee if any cybersecurity incident leads to a breach or loss of any data. These members of senior management are responsible for promptly determining if such an incident is material and notifying our CEO, CFO and our Board of Directors of the material incident and the impact that the incident has had, and is expected to have, on the Company's reputation, results of operations, financial condition, and business strategy. The Company engages third-party auditors and consultants to evaluate and assist the Company in responding to cybersecurity threats and incidents, and, if necessary, monitoring any exposure of confidential company or customer data. The Company also actively engages with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies, procedures and strategy, assess our security status, and align our cybersecurity practices with current and emerging cybersecurity risks.

companyName: M/I HOMES, INC.

ticker: MHO


text: IT/ cybersecurity firm reports to our Chief Executive Officer ("CEO"). The third-party firm is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals within its team and through the use of technological tools and software. Our CEO reports directly to the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues. Cybersecurity reviews by the Board of Directors will occur at least annually, or more frequently as determined to be necessary or advisable.

companyName: BION ENVIRONMENTAL TECHNOLOGIES INC

ticker: BNET


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we regularly evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: While we have not, as of the date of this 2023 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See "Risk Factors" for more information on our cybersecurity risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: While to our knowledge no previous cybersecurity incidents have occurred, we seek to continuously expand and improve our information technology systems, including implementing new internally developed and/or external industry standard enterprise resource planning systems ("ERP systems"), to assist us in the management of our business. We maintain information technology measures designed to protect us against intellectual property theft, data breaches and other cyber-attacks. The implementation, maintenance and improvement of these systems require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving and expanding our core systems as well as implementing new systems, including the disruption of our data management, procurement, manufacturing execution, finance and supply chain processes. Elements our cybersecurity information technology measures include efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through: • Cybersecurity risk assessments for identification of material cybersecurity risks to our critical systems, information, products, and our technology environment; • Security personnel and vendors responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Training and awareness programs for our personnel and senior management to drive adoption and awareness of cybersecurity processes and information technology measures; • A cybersecurity monitoring program responsible for tools that produce alerts and reports of suspicious activity for the prevention of and response to cybersecurity incidents; • Internal testing and assessments, where appropriate, of our cybersecurity information technology measures; • Management of external consultants and services engaged by us, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity information technology measures; and • A third-party risk management process for evaluating cybersecurity threats associated with our use of service providers, suppliers, and vendors.

companyName: Cenntro Inc.

ticker: CENN


text: As part of its cybersecurity oversight role, the Audit Committee meets regularly with the Company's executive officers and senior IT personnel to discuss the Company's policies, procedures and other measures put in place to protect its business systems and information against cyber-related attacks and risks, as well as to discuss recent cyber and IT trends.

companyName: EQC Liquidating Trust


text: Our Board of Directors oversees our risk management, including our information technology and cybersecurity policies, procedures, and risk assessments. Management reports to our Board of Directors on information security matters as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Artisan Consumer Goods, Inc.

ticker: ARRT


text: Caterpillar's cybersecurity program is overseen by the Caterpillar CIO, who has been a Caterpillar employee for nearly twenty-five years. Prior to her current appointment as Caterpillar's CIO in September 2020, she was the Chief Information Officer for the Caterpillar's Financial Products Division, which includes Cat Financial. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. The Caterpillar CIO leads a cross-functional cybersecurity team comprised of professionals from Caterpillar's product, cybersecurity, legal and compliance organizations who focus on managing the security of Caterpillar's connected solutions. This team manages the Caterpillar's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers. It also includes a comprehensive disaster recovery plan that is continually tested and designed to help enable us to resume business in the event of a disaster or cybersecurity incident. Through recurring internal and external audits, controls are regularly reviewed, tested, and enhanced to promote best practices. The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Security Officer (CISO) duties such as counter-threat intelligence.

companyName: ATLANTIC AMERICAN CORP

ticker: AAME


text: The operating systems of Federated Hermes, and its offerings, customers, shareholders and service providers are dependent on the effectiveness of information security policies and procedures (both at Federated Hermes and at third parties, such as its service providers) which seek to ensure that such systems are protected from cybersecurity incidents. Federated Hermes has established a robust cybersecurity program aimed at assessing, identifying and managing material risks from cybersecurity threats.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and penetration testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.

companyName: WELLTOWER INC.

ticker: WELL


text: We also engage third parties in connection with our cybersecurity risk management processes, including cybersecurity consultants and auditors, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001 and PCI-DSS. In addition to monitoring risks from threats to our own assets, we administer a third-party risk management program that endeavors to help identify and manage risks from cybersecurity threats arising from our suppliers and other service provider organizations. This program seeks to combine a methodology for risk ratings with targeted cybersecurity assessments, security-focused contractual requirements, and monitoring activities based on the risk profile of covered suppliers and service providers.

companyName: Dell Technologies Inc.

ticker: DELL


text: The Audit Committee receives detailed quarterly reports from management about our cybersecurity risks, and management provides timely updates to the Audit Committee about any significant cybersecurity incidents, as well as those with lesser impact potential if deemed appropriate to do so.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: Noble's cyber security program encompasses mandatory cyber training, awareness, phishing exercises, and cyber security incident response plan testing to assist with our cyber security risk management process and ensure various applicable implemented cyber controls are working as intended.

companyName: Noble Corp plc

ticker: NE


text: The Board has overall responsibility for risk oversight, including risks related to cybersecurity threats. The Board is aware of the critical nature of managing these risks and has sought to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity and appropriate review of the protections provided to us by the Investment Adviser.

companyName: SLR Investment Corp.

ticker: SLRC


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.

companyName: Premier Air Charter Holdings Inc.

ticker: PREM


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply and formally attest to these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees annually, and it is supplemented by testing initiatives, including periodic phishing tests.

companyName: Rimini Street, Inc.

ticker: RMNI