text: The Company periodically conducts cybersecurity "tabletop" exercises administered by an independent third-party in which members of a cross-functional team and relevant third-party vendors engage in simulated cybersecurity incident scenarios. These exercises are intended to provide hand-on training for the participants and assists the Company with assessing its processes and capabilities in addressing cybersecurity threats.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, DDoS and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the CSIRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises, and cyber incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.

companyName: EVEREST REINSURANCE HOLDINGS INC

secItem: Item 1C


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Business Manager to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us and our Business Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us and our Business Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.

companyName: Inland Real Estate Income Trust, Inc.

ticker: INRE


text: Impact of Material Risk To date, no cybersecurity incidents have materially impacted the Company, including the Company's business strategy, results of operations, or financial conditions. However, financial institutions face risks from threat actors that focus on attacks of critical information systems infrastructure assets, disruption to operations, and ransomware groups that steal data, encrypt systems, and demand a payment. The Company relies on third-party software, third-party hardware, and third-party vendors to manage critical aspects of our operations which may be at risk of cybersecurity threats. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, and when detected by security tools or third parties, may not always be immediately understood or acted upon. Although the Company has implemented cybersecurity policies, procedures and controls intended to mitigate these risks and the likelihood of these risks occurring may not be high, if these risks are realized the impact could be material, such as in the event of a material cybersecurity incident.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity risk management program. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives periodic briefings from the Audit Committe on our cybersecurity risk management program.

companyName: Seer, Inc.

ticker: SEER


text: Our cybersecurity risk management program is supported by both management and our Board of Directors, and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: FuboTV Inc.

ticker: FUBO


text: The CISO is notified of cybersecurity events as needed based on the Company's processes for addressing cybersecurity incidents and threats. The CISO is supported by a team that includes the SOC, which consists of the Deputy Chief Information Security Officer and other cybersecurity professionals as well as a team of third-party contractors. The SOC, with the assistance of outside third-parties as needed, analyzes, evaluates and remediates cybersecurity incidents and provides investigative information to the CISO. Depending on the significance of any specific cybersecurity incident or threat, and/or relation to prior incidents, the CISO will escalate relevant information, as appropriate, and the Company's legal and accounting groups, with assistance from other company departments and third parties, will assist in assessing potential SEC disclosure obligations. The CISO coordinates disclosure to other agencies, when necessary, including requirements under the Transportation Security Administration directives.

companyName: CSX CORP

ticker: CSX


text: We are committed to ensuring the confidentiality, availability and integrity of our data. Our cybersecurity strategy is informed, maintained and updated through various methodologies and external resources. As the concerns and issues evolve in cybersecurity, we remain focused on resiliency and continuous improvement to help enhance our cyber posture. We regularly reevaluate the threat landscape and evolve our controls to address new vulnerabilities and threats.

companyName: GTJ REIT, INC.


text: The Company maintains a general security policy, which outlines the relationship between employees and information technologies and systems within the Company, and sets guidelines on how such technologies and systems should and should not be used. This policy is revised regularly by the CISO and reviewed and acknowledged by all Company employees in conjunction with annual cybersecurity training. The Company also has a Systems Security Policy in place, which outlines the requirements for system configuration and administration of systems within the Company, and includes steps for reporting cybersecurity incidents and keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: MAGNITE, INC.

ticker: MGNI


text: We use third-party service providers to perform a variety of functions throughout our business, such as using application providers for core applications (including finance, HR, CRM, email services, collaboration tools etc.), hosting companies for our websites, contract manufacturing organizations, distributors and supply chain resources for software, hardware, manufacturing and distribution of our products. We have a vendor management process for managing cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NETGEAR, INC.

ticker: NTGR


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: QVC INC

ticker: QVCD


text: The Company's team responsible for developing and executing our cybersecurity policies together with our CIO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience. Additionally, leaders in the Company's information technology function receive periodic training and education on cybersecurity-related topics. The CIO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We depend on a variety of information systems and technologies (including cloud technologies) (collectively, "IT Systems") to manage our business. We rely on these IT Systems to provide information for substantially all of our business operations, including supply chain, order processing, e-commerce, human resources, legal, compliance, marketing, finance, and accounting. Our core IT Systems consist mostly of purchased and licensed software programs that integrate together and with our internally developed solutions. As part of our risk management program, we monitor and assess the risks posed by cybersecurity threats to those internal and external systems and solutions and maintain an information security program designed to mitigate such risks.

companyName: Dorman Products, Inc.

ticker: DORM


text: Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. The Company does not currently engage assessors, consultants, auditors, or other third parties in connection with any such processes. Other than the integration of the Company's cybersecurity processes with the Company's overall risk management systems, the Company does not have specific processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider.

companyName: Next Bridge Hydrocarbons, Inc.


text: Board of Director Oversight The Audit Committee of the Company's Board of Directors is responsible for overseeing the Company's cyber risk. The Audit Committee receives regular updates that encompass a broad range of topics, including: • Current cybersecurity threat landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; • Regulatory updates; • Vulnerability developments; and • Other cyber risk topics as requested by the Board.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy requires that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.

companyName: Calumet Specialty Products Partners, L.P.


text: Our cyber risk management program helps mitigate risks that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Security breaches and other disruptions could compromise our information and expose us to liability, and could cause our business and reputation to suffer.

companyName: INTEGRATED BIOPHARMA INC

ticker: INBP


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 4 years and has worked in the financial services industry for 19 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.

companyName: AB Private Credit Investors Corp


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Chief Information Security Officer ("CISO") leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our risk management group works with our cybersecurity team to continuously evaluate and address cybersecurity risks. Further, we have an employee security awareness program in place and a security training program for technical personnel that provides mandatory and on-demand training.

companyName: Allegion plc

ticker: ALLE


text: provide mandatory training and notifications for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to understand, identify and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: Profound Medical Corp.

ticker: PROF


text: Security and privacy incident response We have in place an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. The CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.

companyName: PENTAIR plc

ticker: PNR


text: The Company, the Advisor and StepStone Group are affiliates of StepStone Group Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC and whose securities are registered with the SEC pursuant to Section 12(b) of the Exchange Act. In general, the Company relies upon the information systems and other enterprise services provided by StepStone Group Inc. and its subsidiaries, including StepStone Group and the Advisor (together, "STEP").

companyName: Stepstone Private Credit Fund LLC


text: In the last three years, we have not experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition. However, there can be no guarantee that we will not experience such an incident in the future.

companyName: Atlas Lithium Corp

ticker: ATLX


text: Our global information security team led by our CISO works in coordination with these management committees and other cross-functional teams and is principally responsible for overseeing our information security strategy, working collaboratively with business leaders across the organization to assess, identify, and manage risks from cybersecurity threats, and to address cybersecurity incidents when they arise. Our information security program is operated on a 24/7 basis to address risks from cybersecurity threats and to respond to cybersecurity incidents globally.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices adjusted as necessary. As part of our ongoing cybersecurity risk management program, we have from time-to-time identified risks or threats to our digital and corporate systems, including attempts to obtain team member credentials through bot and phishing attacks or through social engineering. While these risks and threats, as well as others we identify, require active and ongoing efforts to mitigate, we have not currently identified any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Shake Shack Inc.

ticker: SHAK


text: o Periodic Updates: The Board receives periodic updates from management, responsible staff, and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We have an enterprise-wide information security program designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, detect, escalate, investigate, and remediate identified risks and security incidents in a timely manner. We also maintain a third-party security program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we often rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ManpowerGroup Inc.

ticker: MAN


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Risk Management Program, which is implemented through a Vendor Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Risk Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Vendor Relationships: Risk Management. The Vendor Risk Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats in addition to other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President of Information Services.

companyName: EXAGEN INC.

ticker: XGN


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risk s. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: American Strategic Investment Co.

ticker: NYC


text: Index to Financial Statements We also maintain an incident response plan to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan is tested annually, with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Senior management works collaboratively across the organization to implement a program designed to protect our information systems from cybersecurity threats and to respond to any cybersecurity incidents in accordance with our incident response and recovery plans. A cross-functional team addresses cybersecurity threats and responds to cybersecurity incidents through communications within the team and with third-party experts to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and report such incidents to the board of directors and the Audit Committee when appropriate.

companyName: I-ON Digital Corp.

ticker: IONI


text: Our CIO manages our information technology systems. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical, and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Key elements of our Cybersecurity and Privacy Programs include, bu t are not limited to the following: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does, consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies, and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: The Board of Directors recognizes the critical importance of managing cybersecurity risks and has implemented robust oversight mechanisms designed to ensure effective governance in this area.

companyName: NERDWALLET, INC.

ticker: NRDS


text: We periodically engage assessors, consultants, auditors and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight for areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.

companyName: CABOT CORP

ticker: CBT


text: We have established a risk-based process for assessing, identifying and managing material cybersecurity threats. Our security program utilizes various tools, including physical, administrative and technical safeguards designed to help prevent and respond to cybersecurity threats and incidents. As risks are identified, we implement a variety of measures to manage and mitigate these risks such as firewalls, intrusion detection processes/systems, and vulnerability management. We have a Cyber Defense Center that utilizes incident response plans and various tools such as Splunk and Crowdstrike to respond and recover from cyber incidents. We also have an outside firm on retainer should the need arise to obtain additional assistance.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: We provide cybersecurity and information security compliance training for our employees once per year, track completion, and require attestations. We conduct monthly mock phishing attacks to all employees, and cater training specifically to our needs, based on industry trends and potential threats. Select members of our IT Security Team participate in security training focusing on emergency preparedness and remediation, including annual table top exercises to test our security protocols and response times.

companyName: CELESTICA INC

ticker: CLS


text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues. The CTO and other members of the Company's management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, such as briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged; and alerts and reports produced by security tools deployed in our IT environment.

companyName: ESSEX PORTFOLIO LP


text: Risks from Cybersecurity Threats As of the date of this report, while we are not aware of any material risks from cybersecurity threats, including cybersecurity incident, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, there can be no guarantee that there will not be a future cybersecurity incident that will have a material impact. In the event of a cybersecurity incident, our insurance coverage may be inadequate to compensate us for any related losses we incur and, in some cases, our insurance coverage may not cover the cybersecurity incident at all. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. Risk Factors – "We are exposed to risks related to cybersecurity and protection of confidential information" of this Annual Report on Form 10-K.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Our cybersecurity program is aligned with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and we periodically engage third parties as part of our continuing efforts to evaluate, enhance and test the adequacy and effectiveness of our security measures and controls. We require our third-party service providers to implement and maintain comprehensive cybersecurity practices commensurate with the services they perform for us, and consistent with applicable legal standards and practices. In addition, we maintain and test a business continuity plan that is designed to allow us to continue to operate in the midst of certain disruptive events, including disruptions to our IT systems, and we have an incident response plan that is designed to address information security incidents, including any breaches of our IT systems.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, including how such risks may materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. Management of the Company uses both internal and external inputs—such as threat intelligence feeds, penetration test reports, and third-party cybersecurity assessments—to update these risk evaluations. During the reporting period, the Company had not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Amedisys recognizes the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined by the SEC in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption, intellectual property theft, fraud, extortion, harm to employees or patients, violation of privacy or security laws and other litigation and legal risk. Amedisys has implemented various cybersecurity related processes, technologies and controls to enhance our efforts to assess, identify and manage such material risks.

companyName: AMEDISYS INC


text: In managing material risks from cybersecurity threats, we require that a security and technical architecture review is conducted for all new software and applications, and for all changes to the underlying IT infrastructure that manages, processes, stores, or transmits our data or data of our customers, vendors, suppliers, joint ventures, or employees. Any deviations from our IT security policies and standards are assessed by our IT security team. Any critical and high-risk levels are identified, documented and reported to relevant key stakeholders.

companyName: TEAM INC

ticker: TISI


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Report on Form 10-K, including the risk factors entitled "Third parties might attempt to gain unauthorized access to our network or seek to compromise our products and services."

companyName: Peraso Inc.

ticker: PRSO


text: In assessing cybersecurity threats, our IT Department has established controls and procedures for responding to cybersecurity incidents, including a process to evaluate the significance of a cybersecurity incident. Members of senior management, including our General Counsel and CFO, are tasked with performing a materiality assessment in the event of a cybersecurity incident, which includes the consideration of relevant quantitative and qualitative factors, as well as SEC guidance. Based on the results of this evaluation, further escalation of the cybersecurity event may occur, which may include our CEO, our board of directors and/or law enforcement. In addition, members of senior management will determine, based on the assessment described above, whether the cybersecurity incident requires disclosure with the SEC.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: Presidio Property Trust has a cross-departmental approach to addressing cybersecurity risk, including input from senior management, employees, external consultants, and our Board of Directors (the "Board"). Senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner, including providing periodic training to staff and periodic review of the Company's current posture to protect against threats. The Audit Committee of the Board of Directors oversees the steps taken by Presidio Property Trust's management to monitor and mitigate cybersecurity risks. Senior management briefs the Audit Committee and the Board of Directors on cybersecurity matters as necessary.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: Cybersecurity risk management is part of the Company's overall risk management program. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Treasurer with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors. There were no material cyber security incidents discovered in 2023.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: The Council also includes, among other senior executives, our CIDO, Chief Engineer, Chief Information Officer, Chief Aerospace Safety Officer and Chief Product Security Engineer, who each have several decades of business and senior leadership experience managing risks in their respective fields, collectively covering all aspects of cybersecurity, data and analytics, product security engineering, enterprise engineering, safety and the technical integrity of our products and services.

companyName: BOEING CO

ticker: BA


text: The VP, Information Technology has been with our Company for over five years in the roles of Director, Global IT Engineering & Sr Director, Global IT Engineering. Prior to joining our Company, the VP, Information Technology was the founder, President and CEO of RjR Innovations, a North American industry leader in IT Service Management. Throughout his 27-year career within the Information Technology industry, he has been an ITIL Best Practice Conference Speaker & Keynote Speaker at several events. The VP, Information Technology is supported by the Senior Director Cybersecurity & IT Risk who has over ten years in a senior cybersecurity leadership role. He holds certifications in CISM (Certified Information Security Manager) from ISACA and PCIP (Payment Card Industry Professional) from the PCI Security Standards Council.

companyName: Canopy Growth Corp

ticker: CGC


text: For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Development and Commercialization of Our Current and Future Product Candidates" and other risks described in the "Risk Factors" section of this Annual Report on Form 10 -K.

companyName: Genprex, Inc.

ticker: GNPX


text: Public Storage devotes significant resources to protecting and continuing to improve the security of its computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage.

companyName: Public Storage

ticker: PSA


text: Our VP of Technology & Senior Security Officer is responsible for overseeing our cybersecurity risk management program. Our VP of Technology & Senior Security Officer has over 20 years of extensive experience in information technology and security, and works in coordination with other members of the management team.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic trainings.

companyName: QUALYS, INC.

ticker: QLYS


text: The Company has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continuously evaluate and enhance its cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. The Company uses automated tools that monitor, detect, and prevent cybersecurity risks that are monitored by the technology department and a third-party vendor. As noted above, the Cybersecurity Committee is also implementing comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Committee escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, based on the materiality of the event.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Internal audit performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.

companyName: Phillips 66

ticker: PSX


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us. See "Item 1A. Risk Factors" in this Annual Report for additional discussions about cybersecurity-related risks.

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a third-party consultant with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's consultant is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also provides annual trainings for all employees designed to reinforce the Company's information technology risk and security management policies, standards and practices, as well as the expectation that all employees comply with these policies. These trainings are supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: Cybersecurity Risks In addition to the reliance on our own information technology systems, we rely on the information technology systems of our hotel managers to protect proprietary and customer information as well as our third-party service providers who support key portions of our operations. Any compromises of our own network or the networks of our hotel managers or third-party service providers could materially affect our business, financial condition and results of operations. For a discussion of our cybersecurity risks, refer to "Part I - Item 1A. Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our information technology systems or the information technology systems of our hotel managers or third-party service providers could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K. Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us. We carry insurance that helps provide protection against the potential losses arising from cybersecurity incidents, although we may incur expenses and losses related to a cybersecurity incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "—We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Uber Technologies, Inc

ticker: UBER


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company to date. While we are not currently aware of any cybersecurity threats that are reasonably likely to materially affect the Company, there is no assurance that we will not be materially affected by such threats in the future. For additional information on our risks related to cybersecurity, see Item 1A, Risk Factors—Operational Risks.

companyName: AMES NATIONAL CORP

ticker: ATLO


text: Security audits and assessments - We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC systems and personnel. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " Our information technology systems, or those of our CROs, contractors, consultants, or other third parties with whom we work, may fail or suffer security breaches, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business. "

companyName: CalciMedica, Inc.

ticker: CALC


text: We have implemented mechanisms to monitor and manage cybersecurity threats and incidents, including utilization of tools for continuous monitoring of our IT environment to detect and mitigate threats, a fundamental plan for responding to cyber incidents and training for employees to recognize and report potential cybersecurity incidents and to foster a culture of cybersecurity awareness and vigilance.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess its cybersecurity preparedness and our initiation or continued engagement with it. Additionally, third-party vendors are required to include security and privacy addenda to our contracts where determined applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: In its privacy policy, the Company outlines its data-sharing practices, stating that personal data is not sold or rented to third parties without permission. The company may disclose personal data in response to legal requirements or to establish or exercise its legal rights.

companyName: FDCTECH, INC.

ticker: FDCT


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. Our management will promptly report to the board of directors on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. As of the date of this annual report, we have not encountered any cybersecurity incidents that have materially affected, or that we believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. We do, however, face risks from cybersecurity threats.

companyName: Planet Green Holdings Corp.

ticker: PLAG


text: Despite our cybersecurity governance program, we cannot assure you that we will be able to effectively prevent, detect or respond to all cybersecurity incidents, which may have a material adverse impact on our reputation and our results of operations.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: The audit committee receives periodic updates from management and our external third party information technology consultant regarding the effectiveness of the systems and processes we have implemented designed to safeguard our information assets and operational integrity from cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems, and regarding other cybersecurity matters, including the results from cybersecurity systems testing and any recent cybersecurity incidents and related responses. Our audit committee is also notified between such updates as soon as practicable regarding significant new cybersecurity threats or incidents. The audit committee also receives a report on cybersecurity matters and related risk exposures periodically from our Chief Financial Officer.

companyName: Protagenic Therapeutics, Inc.\new

ticker: PTIX


text: Effect of Risk face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, and penetration testing to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: We have developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who, in collaboration with the Company's Information Security department, are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee within 24 hours of their designation as high-risk by the Technology Risk Management Committee.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Our CTO also provides such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over four years and has over three decades of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.

companyName: Biohaven Ltd.

ticker: BHVN


text: We also maintain an internally staffed cybersecurity operation center, which performs security monitoring and is directly responsible for our efforts to monitor, prevent, and detect cybersecurity incidents, as well as for appropriate and timely escalations concerning cybersecurity incidents that are discovered. Under our Cybersecurity Program, identified cybersecurity events and incidents are reported to our dedicated incident response team, which includes various members of our legal and compliance teams, cybersecurity team, relevant business teams, executive management, and, as warranted, our third-party security, audit, and consulting partners. Our program also retains an external third-party firm to activate as a supplement in the event of a significant security incident.

companyName: Oportun Financial Corp

ticker: OPRT


text: Our cybersecurity risk management program is a significant part of our overall risk management program. Teams of internal and third-party cybersecurity professionals oversee cybersecurity risk management, which incorporates elements of the National Institute for Standards and Technology Cybersecurity Framework.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology (IT) environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Seer, Inc.

ticker: SEER


text: Our approach to cybersecurity begins with our responsibility for strong governance and controls. Security begins at the top of our organization, where Company leadership consistently communicates the requirements for vigilance and compliance throughout the organization, and then leads by example. Our diligence and assessment extend beyond West, as the Company performs a cybersecurity assessment when third-party vendors and service providers are onboarded. Throughout the year, we monitor the effectiveness of our third-party vendors' and service providers' control environment, assessing any impact to our Company. The cybersecurity program is led by our Chief Information Officer and our VP of Cybersecurity and Infrastructure Support, who provide periodic updates to the Audit Committee of our Board of Directors, annual updates to the Board of Directors, and regular reports to the West Leadership Team about the program, including information about cyber risk management governance and the status of ongoing efforts to strengthen cybersecurity effectiveness. Additionally, our ERM program enables a portfolio view of the risks inherent in our business, including cybersecurity. The ERM function monitors and reports on these top risks with periodic updates to the Audit Committee and our Board of Directors, annual updates to the Board of Directors, and regular reporting to the West Leadership Team on risk mitigation and response efforts. Security controls and processes are developed and maintained to protect sensitive and confidential information while ensuring availability and integrity.

companyName: WEST PHARMACEUTICAL SERVICES INC

ticker: WST


text: Notwithstanding the approach we take to cybersecurity risk management, we may be unsuccessful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: We also enact a process to perform a risk assessment of new third-parties, inclusive of new third-party contracts, which provides an additional layer of oversight in identifying material risks associated with the use of particular external service providers.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: The Bank has implemented processes for assessing, identifying, and managing risks from cybersecurity threats or incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition. Please refer to Item 1A. Risk Factors for a description of cybersecurity incident and threat risk.

companyName: Federal Home Loan Bank of Atlanta


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. Our executive management team inform our audit committee on cybersecurity risks on a regular basis, at least once per year.

companyName: Greenpro Capital Corp.

ticker: GRNQ


text: • Management of the Company's wholly-owned subsidiary, United Security Bank (Bank), reports to the Board of Directors, or an appropriate committee of the board, at least annually. This report describes the overall status of the information security program and the Bank's compliance with these guidelines. • The report discusses material matters related to the information security program, addressing issues such as: risk assessment; risk management and control decisions; service provider arrangements; results of testing; security breaches or violations and management's responses; and recommendations for changes in the information security program. • The intent of this report is to communicate the overall status of the information security program, including any updates to the program components. • In regard to cybersecurity threats and controls, the information security program addresses the Bank's cybersecurity strategy. • Cybersecurity is an element of information security. Information security deals with information, regardless of its format – paper documents, digital and intellectual property, and verbal or visual communications. • Cybersecurity focuses on protecting digital assets from intentional attacks. These assets include networks, computer hardware/software, and information that is processed, stored, or transported by networked systems and devices. • The Information Security Program was initially designed, and is regularly updated, to comply with the following laws and regulations:

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: Effective assessment, identification and management of material risks from cybersecurity threats involve a comprehensive and proactive approach. The Company's key processes include, but are not limited to, the following:

companyName: DallasNews Corp


text: The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Longeveron Inc.

ticker: LGVN


text: Our IT security management team, led by certain key functional leaders in our organization, who reports quarterly in meetings to our Audit Committee and periodically to our Board of Directors regarding updates to our cybersecurity program and related risks. Topics in the meetings include discussion of the company-wide risks, protocols to mitigate such risks, and the progress of initiatives in the cybersecurity program. Specific cybersecurity briefing areas may include topics such as security, infrastructure, cybersecurity tooling/applications, and compliance.

companyName: Avinger Inc


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to help manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a corporate security incident response plan, a vulnerability management policy, incident detection and response processes, IT systems disaster recovery procedures, risk assessments, reasonable implementation of security controls in accordance with applicable security standards/certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer. We also rely on third-party vendor backup/restore, disaster recovery and business continuity procedures as stated in the respective SOC 1 and SOC 2 reports if provided by such vendors as they pertain to certain of our managed services.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Continuous improvement is a critical aspect of Parker's cybersecurity program, which is why we integrate security intelligence from internal and external sources to help identify areas for improvement and gap remediation. As a supplement to our internal cybersecurity capabilities and controls, we partner with third-party consultants and advisors to conduct penetration testing and to assess our incident response plan. We periodically undergo a third-party risk assessment and third-party incident response adversarial engagement exercises to strengthen our security profile. We also conduct internal tabletop exercises to prepare for responding to potential cybersecurity events. Parker also maintains cyber security insurance designed to mitigate the impact of any attacks or threats to our business.

companyName: Parker-Hannifin Corp

ticker: PH


text: When utilizing third-party software for key services, we seek to engage those that are reliable, reputable, and maintain cybersecurity controls. To address risks associated with third-party providers for critical services, we review available audit reports of controls from such providers to assess and manage any identified risks.

companyName: MAYS J W INC

ticker: MAYS


text: Our processes also address cybersecurity risks associated with our use of third-party service providers and other external parties and circumstances. External risks to our network and information systems may arise from third parties and other parties we may not fully control. For example, we use vendors for encryption and authentication technology and cloud storage, and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery. We engage outside providers to monitor our network and conduct periodic internal and external security testing and to assist in the ongoing evaluation and enhancement of our cyber security preparedness and protocols. We use the NIST Cybersecurity Framework to audit our cybersecurity controls.

companyName: Frontier Communications Parent, Inc.


text: We have a cross-functional Cybersecurity Board led by our Vice President of Information Technology & Corporate Projects serving as the chair and consisting of executive-level and non-executive level leaders, including among others, our Chief Financial Officer. This board is responsible for reviewing, engaging and making decisions related to the execution and continuous improvement of cybersecurity strategy, processes and governance impacting our information systems, employees, partners and patients. Our Vice President of Information Technology & Corporate Projects leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Vice President of Information Technology & Corporate Projects is an experienced senior leader with more than 20 years of experience in information technology within the pharmaceutical industry leading a team of employee and consultants with a breadth of experience including security management experience along with CISSP certification.

companyName: ARVINAS, INC.

ticker: ARVN


text: We utilize an Amazon Relational Database Service (AWS RDS) for data storage, which resides within a private network to safeguard sensitive information. Only the front-end interface is exposed to the internet via port 80, while the rest of the application stack remains shielded behind AWS's firewall. This setup effectively blocks unauthorized external access, ensuring that only legitimate user requests reach our application.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, multi-factor authentication, and single-sign on for all employees required to access line of business applications, intrusion prevention and detection systems, anti-malware functionality and access controls. Our technical safeguards are evaluated and improved through the use of first and third party vulnerability assessment tools and cybersecurity threat intelligence.

companyName: VINEBROOK HOMES TRUST, INC.


text: The Board of Directors will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.

companyName: NKGen Biotech, Inc.


text: Management discusses strategic and operational risks at regular management meetings and conducts specific strategic planning and review sessions throughout the year. Throughout the year, senior management reviews these risks, including with respect to cybersecurity, with the Board of Directors at board meetings from time to time as part of management presentations that focus on particular business functions, operations or strategies and presents the steps taken by management to mitigate or eliminate such risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could adversely affect our business, data or information systems that we use or own.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: As appropriate, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the company's incident response processes. The Information Security organization and Corporate Risk & Compliance division are informed about and monitor the prevention, detection and mitigation of cybersecurity incidents through risk and control assessments, targeted reviews, scenario analysis, and monitoring of risk metrics. The company's performance in managing cybersecurity risk is reported to the Technology Risk Committee, the Enterprise Risk Committee and the Board of Directors.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Company's Board of Directors provides oversight of the Company's cybersecurity risks through its Audit Committee. Four of the eight members of the Board of Directors, and three of the four Audit Committee members, possess skills related to information technology and cybersecurity. The Audit Committee reviews the Internal Audit team's cyber-related control audits to confirm that cyber risks are being appropriately managed and also reviews a periodic report produced by the CIO and CISO on the performance of the Company's cybersecurity program. In addition, the CIO and CISO present a comprehensive cybersecurity update to the full Board of Directors on at least an annual basis.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: We utilize third-party service providers to enhance our CSP, including engaging them annually to assess our CSP against the NIST CSF. We use one or more third-party managed security solution providers, who provide us with threat intelligence information and managed threat detection and response capabilities. We have also engaged a third party to assist with associate cybersecurity training. Additionally, we have engaged outside breach response legal counsel to assist the Company with cybersecurity counseling and incident response.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: We routinely undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents, including assessments of our data access in the form of user audits, real-time monitoring of risk on a per system level as it pertains to AV completeness, system vulnerabilities, and third-party patching. In addition to this, we actively monitor and practice disaster recovery and business continuity plans in the event that any risk is able to circumvent the controls we have in place.

companyName: PIONEER POWER SOLUTIONS, INC.

ticker: PPSI


text: The audit committee assists the board of directors in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board of directors.

companyName: HUBSPOT INC

ticker: HUBS


text: Managing Third-Party Risk We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf or have access to our information systems, and we have processes in place to oversee and manage these risks. We conduct thorough security assessments of these third parties engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: The Chief Information Officer with the support from the Chief Executive Officer and Chief Financial Officer, assisted by our broader IT team, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. Additionally, information security awareness trainings and testing are a compliance requirement for employees.

companyName: LSI INDUSTRIES INC

ticker: LYTS


text: We believe that cybersecurity and business resilience are critical to advancing our corporate vision and enabling our digital transformation efforts. As a technology services provider, we are faced with a multitude of diverse cybersecurity threats that range from common attacks such as ransomware, denial of service, and social engineering to more advanced attacks leveraging sophisticated AI-enabled tools from nation-state actors that might target our ecosystem through specific industry verticals. Any such cybersecurity threats could affect our customers, vendors, service providers, subcontractors and/or employees, and a cybersecurity threat to us or any of these entities could materially adversely affect our business strategy, financial condition, performance, our brand and results of operations.

companyName: EPLUS INC

ticker: PLUS


text: Protect our information assets and operations from internal and external cyber threats, Safeguard employee, vendor, and collaborator information from unauthorized access or attack, and Secure our networks and systems.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: The Company's Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee. The Company's Chief Technology and Information Officer (CTIO) and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third parties. We have processes in place to assess, identify, manage and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including maintaining an effective security management program and abiding by information handling and asset management requirements. We have an escalation process in place to inform senior management and the Board of Directors of these material issues.

companyName: KonaTel, Inc.

ticker: KTEL


text: We have implemented and maintain various information security processes designed to detect, respond to, recover, and protect our technology ecosystem from cybersecurity threats. These processes are designed to identify, assess, and manage material risks that may result from cybersecurity threats and apply to our critical technologies inclusive of networks, third party hosted services, communications systems, hardware, software, and critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, penetration testing services, and other third-party service providers including for identity management solutions.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: As we have positioned ourselves as a public company acquisition vehicle, and have limited operations, we do not have any significant operations that face cybersecurity threats. Although we do depend on the digital technologies of third parties, and any deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, information and sensitive or confidential data, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Viskase Holdings, Inc.

ticker: ENZN


text: We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our internal and customer facing IT Systems and Confidential Information.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: Our CISO provides reporting to the Risk Management Committee and Operations and Technology Committee of our Board of Directors on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, as needed when there are status updates or changes. Our CISO reports annually (or more often as needed) to the full Board of Directors on the Bank's cybersecurity risk management program. The Bank's Enterprise Risk Management team, which is part of the Bank's risk management function, provides quarterly reports to the Risk Management Committee (and ultimately, the Board of Directors) on the Bank's risk tolerance conditions, including reports on any cybersecurity matters that may fall outside of the Bank' risk tolerance conditions. Our Board of Directors provides oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and Federal Home Loan Bank of Chicago (Dollars in tables in millions except per share amounts unless otherwise indicated) controls.

companyName: Federal Home Loan Bank of Chicago


text: We maintain a Crisis Management Plan that addresses our preparation for, management, recovery from, and ultimate resumption of business after a crisis, including emergency response, continued recovery, and business resumption activities such as information systems recovery, when a cybersecurity incident may potentially have a significant impact on our business strategy, results of operations, or financial condition.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: The CISO brings nearly two decades of cybersecurity experience to her work at Verizon. Prior to joining Verizon, she held executive-level cybersecurity roles at other large public companies, where she was responsible for cybersecurity strategy and operations, including incident response, threat intelligence, security services, architecture, commercial operational technology security, and regulatory and compliance matters.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: We maintain a Business Continuity Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees. The Business Continuity Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Business Continuity Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: Southern States Bancshares, Inc.


text: A third party Managed Security Service Provider (MSSP) manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer. and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: The Company also maintains an Executive Cybersecurity Steering Committee (the "Cybersecurity Committee"), made up of key members of senior leadership, to oversee and monitor progress of various cybersecurity initiatives throughout the organization. The Cybersecurity Committee meets quarterly. In addition, the Company asks each business unit to designate an employee as the local Information Security Officer responsible for monitoring the business unit's cyber risk dashboard and coordinating with local leadership to respond to identified risks accordingly. Each local Information Security Officer completes an annual certification process and receives regular updates with respect to the Company's cybersecurity program.

companyName: IDEX CORP /DE/

ticker: IEX


text: We are not aware of any specific risks from specific cybersecurity threats, and have not experienced any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. While we continue to invest in the security and resiliency of our information technology systems and to enhance our cybersecurity controls and processes, we cannot provide assurance that a future cybersecurity incident will not occur or that it would not materially affect our company. Please see Item 1A of Part I of this Annual Report under the heading "Risk Factors" for additional discussion about risks related to cybersecurity.

companyName: OMEROS CORP

ticker: OMER


text: Our institution has purchased and is using best of breed tools in the areas of endpoint security, Security Information Event Management ("SIEM"), Privileged Access Management ("PAM"), email and web browsing filtering and management, and user analytics. We also use a comprehensive third party 24-by-7 Security Operations Center ("SOC") that monitors, detects, and remediates cybersecurity threats adhering to strict service response levels.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Risks from Cybersecurity Threats In the last fiscal year, the Company did not experience any material cybersecurity incidents. For additional discussion of cybersecurity-related risks facing the Company, see Item 1A. Risk Factors.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: cybersecurity risk management program [includes/shall include]: assessments designed to help identify material cybersecurity risks to our Confidential Information, Critical Systems and the broader security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; awareness and spear-phishing resistance training of our employees, and senior management; cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and vendor management policy for service providers.

companyName: Hour Loop, Inc

ticker: HOUR


text: Company has established controls and procedures to escalate enterprise-level issues, including cybersecurity matters, to the appropriate management levels within its organization and to its Board of Directors, or members or committees thereof, as appropriate. The Company's Board of Directors has oversight for enterprise risk management, including its approach to managing cybersecurity risk, and has delegated oversight responsibility of information security risks to its Audit Committee. Matters determined to present potential material impacts to the Company's financial results, operations, and/or reputation are reported by management to the Company's Board of Directors or its Audit Committee, as appropriate, in accordance with its escalation framework.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Governance of cybersecurity risk management The Board of Directors has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.

companyName: AAON, INC.

ticker: AAON


text: In an effort to reduce the likelihood and severity of cybersecurity incidents, we have established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and our business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: VanEck has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Clean Vision Corp

ticker: CLNV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, also integrating security best practices typically used to support the Health Insurance Portability and Accountability Act, or HIPAA, and General Data Protection Regulation, or GDPR, implementations. We use the NIST CSF and such security best practices as a guide to help us monitor, identify, assess and manage cybersecurity risks relevant to our business; however, this does not imply that we meet any particular technical standards, specifications or compliance requirements.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: We have in the past experienced attempts and incidents by external parties to penetrate our, our service providers', and our business partners' networks and systems. Such attempts and incidents to date have not had a material adverse effect on our business, financial condition, or results of operations. See Part I Item 1A of this Form 10-K for more information on risks.

companyName: Alcoa Corp

ticker: AA


text: Day to day cybersecurity risk oversight governance is the responsibility of our Vice President, Cyber Security who has been with Tronox since 2017 and reports to our Senior Vice President, Integrated Supply Chain and Digital Transformation. Tronox's Vice President, Cyber Security has over 30 years of IT experience, 20 years of security experience and was awarded a Member of the British Empire honor with respect to his work in the field. Previous roles include Interim Chief Information Security Office for Pacnet (Hong Kong) and Director of Security for Level 3 Communications along with multiple engagements for the UK government. He oversees a dedicated security team distributed globally with more than 15 members and over 100 years of aggregate cyber security experience.

companyName: Tronox Holdings plc

ticker: TROX


text: Our cybersecurity team performs independent reviews of new vendors whose services may be potentially integrated within our enterprise. As part of a standardized review process, our cybersecurity team maintains a Control Assurance Toolkit to review vendor activities, practices, and controls for alignment with our policies and procedures. Resulting control recommendations are coordinated to ensure appropriate implementation during integration activities.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: Management for Williams, Transco, and NWP recognizes the increasing volume and sophistication of cyber threats and takes its responsibility to protect the information and systems under its purview seriously. Management's cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: FIGS, Inc.

ticker: FIGS


text: Management is responsible for the day-to-day administration of the Intuit's cybersecurity policies, processes, practices, and risk management. The Audit and Risk Committee of our Board of Directors provides primary oversight of cybersecurity risks and the Company's efforts to mitigate those risks.

companyName: INTUIT INC.

ticker: INTU