text: Identifying, assessing and managing cybersecurity risks Our cybersecurity team and the owners of information technology systems across the business, led by our Chief Security Officer ("CSO"), monitor current events and trends related to cybersecurity in an effort to anticipate potential risks and threats on current systems and operations. We have implemented or are in the process of implementing various processes to identify, review and track risks to our systems and operations, including through the use of third-party solutions. We also seek to conduct due diligence in connection with the onboarding of new third-party vendors, and reviews are conducted on our critical third-party vendors. Following these assessments, we utilize the findings to improve and mature our cybersecurity practices and to promote continuous improvement. In addition, we have implemented a cybersecurity awareness program to train our employees and contractors on key cyber threats, which includes phishing exercises.

companyName: GRAIL, Inc.

ticker: GRAL


text: Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise IT environment; • A team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls and (iii) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel and senior management, including through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers, and vendors. We employ rigorous vetting processes and ongoing monitoring mechanisms designed to ensure their compliance with cybersecurity standards.

companyName: VORNADO REALTY LP

secItem: Item 1C


text: Each member of the Risk Management Steering Committee, including the business unit representatives and subject matter experts, has substantial experience managing risks at the company and at similar companies, including risks arising from cybersecurity threats. Through ongoing communications with these teams, the CFO, GC and the rest of the Risk Management Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: Vizio Holding Corp.


text: During 2025, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity events, that materially affected us, including our business strategy, results of operations or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, and if realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in "Item 1A. Risk Factors."

companyName: Penguin Solutions, Inc.

ticker: PENG


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: LENSAR, Inc.

ticker: LNSR


text: Chief Compliance Officer and Head of Global Information Technology both help identify, assess, and manage the Company's cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, analyzing reports of threats and actors, evaluating threats reported to us, evaluating our and our industry's risk profile, audits, conducting threat assessments, conducting vulnerability assessments, and conducting tabletop incident response exercises.

companyName: Gamida Cell Ltd.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors in the section under Part I. Item 1A. "Risk Factors" of this Annual Report, including in the subsection titled "Risks Related to Our Business, Strategy and Industry."

companyName: Beta Bionics, Inc.

ticker: BBNX


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store and/or process our confidential data. These information security assessments, include a review of any service organization controls (SOC) reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

companyName: COMMUNITY WEST BANCSHARES /


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences".

companyName: Landos Biopharma, Inc.


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, protect, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools and services that are widely used in the industry, and internal solutions. We have an enterprise-wide Information Security Incident Response Plan ("IRP"), which describes the detailed processes and procedures that should be followed in the event of an information security incident. We conduct assessments based on the National Institute of Standards and Technology cybersecurity framework (the "NIST CSF") to measure our progress under the maturity framework of NIST CSF and continue to identify opportunities for improvement in our information security program.

companyName: Chewy, Inc.

ticker: CHWY


text: Our CISO reports to our Senior Vice President of Information Technology and Product Development ("SVP of IT and PD"). Our SVP of IT and PD has over 45 years of experience in the field of information technology and has earned a relevant degree. Prior to joining Paychex in November 2008, he held senior leadership positions at several technology, financial services, and HCM companies.

companyName: PAYCHEX INC

ticker: PAYX


text: As of the date of this report we have not experienced or aware of any cybersecurity incidents resulting, or reasonably likely to result in, a material impact to us, including to our business, financial condition, and results of operations. There is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.

companyName: Universal Token

ticker: UTKN


text: The Audit Committee oversees, on behalf of our Board of Trustees, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Trustees or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.

companyName: Franklin BSP Real Estate Debt BDC


text: Board Oversight Responsibilities The Board of Directors bears the ultimate responsibility for ensuring that an adequate cyber and information technology risk (IT risk) management framework is in place and functioning as intended. IT risk focuses on information and information systems, especially the most critical and vital information assets. Without reliable and properly secured information systems, business operations could be severely disrupted. Likewise, the preservation and enhancement of the Company's reputation is directly linked to the way in which both information and information systems are managed. Maintaining an adequate level of security is one of several important aspects of managing IT risk. The Board's oversight responsibility in this respect includes oversight of the Company's vendor management program and the periodic evaluation of the Company's IT risk management controls.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: A cybersecurity incident may also require various levels of external reporting. The CSDC coordinates with the legal department and controller's organization in reporting incidents externally. Depending on the nature of the incident, reporting may be required to various federal and state government agencies. DTE Energy has forged trusted partnerships with such agencies and with other companies and organizations to share best practices, tools, and threat information. This includes partnering with others in the utilities industry to form the Electricity Subsector Coordination Council (ESCC). The ESCC is the principal liaison between the energy sector and the federal government in coordinating efforts to prepare for and respond to any threats to critical infrastructure.

companyName: DTE Electric Co


text: The Corporation has an Incident Response Plan that provides a documented guideline for handling potential threats and taking appropriate measures including timely notification and escalation to executive leadership and the Board of Directors. The Incident Response Plan is managed by the Incident Response Team which includes the Director of Information Security, Chief Risk Management Officer, Chief Information Officer, and other essential members of management. The Incident Response Plan is reviewed and tested at least annually.

companyName: CITIZENS & NORTHERN CORP

ticker: CZNC


text: We have experienced and may continue to experience cybersecurity incidents; however, we do not believe any cybersecurity incidents incurred to date have materially affected our Company, including our business strategy, results of operations, or financial condition. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient, and that could subject us to significant risks. For further discussion of how these and other potential cybersecurity risks may impact our business, refer to the risk factor under heading "A cybersecurity breach, disruption or misuse of our information systems, or our external business partners' information systems could have a material adverse effect on our business" in Item 1A. Risk Factors – Operational Risks.

companyName: PERRIGO Co plc

ticker: PRGO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor-Risks Related to Our Stores and Operations-We and our vendors rely on information technology, and any material failure, inadequacy, interruption or security incident affecting that technology could harm our business, results of operations and financial condition."

companyName: Extra Space Storage Inc.

ticker: EXR


text: Our information security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The incident response team works with the Company's management team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's information security incident response plan includes reporting to the board of directors for certain cybersecurity incidents.

companyName: AAON, INC.

ticker: AAON


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Our management team, including our IT management team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Senior Director of IT has served in various roles in information technology and information security for over 25 years.

companyName: SITIME Corp

ticker: SITM


text: 1) Cybersecurity incidents: Our public-facing website complies with WCAG 2.2 level AA standards for accessibility. We manage various databases, including those on Amazon and Google Clouds, each with three sets of development, testing, and production environments. Our main data warehousing solutions is Amazon Redshift, complemented by Amazon S3 for object storage.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.

companyName: APA Corp

ticker: APA


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Information Officer, who reports directly to our Chief Consumer Banking Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: a security team led and supervised by our information technology manager, which is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: 374Water Inc.

ticker: SCWO


text: We have policies and procedures in place to identify, protect, detect, respond and recover from cybersecurity incidents. The life cycle of our incident response includes: (i) preparation through employee training and drills, including regular simulation exercises that include management from various departments in addition to representatives from our information technology security team; (ii) detection and analysis of the cybersecurity incident; (iii) assembling the appropriate response team and escalating the incident to the appropriate parties internally and externally; (iv) containment, eradication, recovery and monitoring; and (v) post incident activity to document the root cause and discuss areas of improvement.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Engage Third Parties on Risk Management As part of our cybersecurity risk management process, MSA engages a range of third parties, including consultants, advisors, and auditors, to assist with security and maturity assessments, security operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and our vulnerability management platform. These relationships enable us to access specialized knowledge and insights with respect to our cybersecurity strategies and processes.

companyName: MSA Safety Inc

ticker: MSA


text: At the management level, John Deere and we jointly maintain a dedicated global team of cybersecurity professionals (Cybersecurity Team) led and managed by John Deere's Chief Information Security Officer (CISO). The Cybersecurity Team is responsible for overseeing John Deere's and our cybersecurity program, including the assessment and management of risks. The Cybersecurity Team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing, and cyber incident management. John Deere's CISO holds a degree in Management Information Systems and has been with John Deere for over ten years. He has over two decades of extensive experience in information technology and cybersecurity and reports directly to John Deere's Chief Information Officer.

companyName: DEERE JOHN CAPITAL CORP


text: As part of Voya's overall information security program, we may engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments.

companyName: Voya Financial, Inc.

ticker: VOYA


text: We have established a cybersecurity incident response plan and provide cybersecurity training to our employees and monitor their activity for adherence to our security protocols.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: Internally, we have a security awareness training platform that includes training to reinforce our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.

companyName: Construction Partners, Inc.

ticker: ROAD


text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board on critical cyber risk and security topics presented to the Audit Committee by management. In addition, informal and ad hoc conversations about cyber risk and industry developments frequently occur among Board members and management.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has over 20 years of experience in IT operations and cybersecurity leadership and is a Certified Information Systems Security Professional (CISSP). The Vice President of Global Information Security also serves on our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: LCI INDUSTRIES

ticker: LCII


text: We maintain robust and comprehensive processes, procedures and controls to protect and secure our information systems and data infrastructure from cybersecurity threats. Our cybersecurity program is led by our Vice President of Technology, who functions as our chief information security officer (" CISO "). Our cybersecurity program interfaces with other functional areas within the Company, including but not limited to our business segments and information technology (" IT ") and legal departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments. We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the International Organization for Standardization (" ISO ").

companyName: Reservoir Media, Inc.

ticker: RSVR


text: Subsidiaries and Operations in Botswana The Company's principal business activity in Botswana is the re-development of the Selebi Mines and the Selkirk Mine (together, the " Botswana Assets ").

companyName: NexMetals Mining Corp.

ticker: NEXM


text: The Board and the Enterprise Risk Management Committee have oversight responsibility for our information security program and receive regular updates on the status of the program and any emerging threats or incidents with the potential to impact operations or financial performance. To ensure that the Board is fully informed about cybersecurity risks, the ISO provides regular reports to both the Board and the Enterprise Risk Management Committee. These regular reports include an overview of the Company's current cybersecurity risk assessment, key risk areas, and any significant cyber incidents that have occurred or are reasonably likely to occur. In addition, the Enterprise Risk Management Committee receives regular updates on cybersecurity trends and emerging threats from program management. Our Audit Committee also plays a role in overseeing the Company's cybersecurity and information security program. The Audit Committee reviews final reports from third-party engagements and receives presentations at its meetings concerning cybersecurity risk and related issues. All members of the Board receive copies of Audit Committee reports.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: To maintain incident readiness, business continuity and IT resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function. These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities. We believe regular practice and evaluation allows us to minimize the impact of potential disruptions and safeguard our operations, data and reputation.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: We have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology within the company. The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal information that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National Institute of Standards and Technology and the International Organization for Standardization. Our internal Risk Management Committee, described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.

companyName: Rumble Inc.

ticker: RUM


text: Our information technology department with the assistance of third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans, penetration testing, vulnerability testing such as phishing simulations and analysis of reported threats.

companyName: OmniAb, Inc.

ticker: OABIW


text: As a publicly traded company and given the industry in which we operate, we have established a risk-based strategy informed by numerous cybersecurity frameworks from regulatory bodies such as PCI, SOX, FAA, TSA, DOT, NIST and DoD. We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet all of the technical standards, specifications or requirements under any of these frameworks. Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.

companyName: Allegiant Travel CO

ticker: ALGT


text: As of the time of filing, there are no known cybersecurity threats that have materially affected or are reasonable likely to materially affect the Company, including its business strategy, result of operations, or financial conditions. The Company pro-actively monitors for cybersecurity threats and responds accordingly to minimize its exposure to such threats.

companyName: Santander Holdings USA, Inc.


text: Risk Assessment and Technical Safeguards Our Information Security Steering Committee (the "Security Committee"), which is led by our Company's Chief Information Security Officer ("CISO"), meets quarterly to prioritize and align actions with business priorities, manage issues, and respond to changes in regulatory requirements. At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants) and includes a tabletop exercise and external and internal penetration testing.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. Specifically, on June 19, 2024, CDK, a third-party provider of certain information systems, notified us that CDK had suspended certain systems used by us in response to a cybersecurity incident impacting CDK. As a result, we experienced disruptions to our dealer management system (the "DMS"), our customer relationship management system (the "CRM") and other systems that support sales, inventory and accounting functions (collectively with the DMS and CRM the "Affected Systems"). On June 26, 2024, CDK began restoring access to certain of the Affected Systems. We performed internal risk assessments and data validation procedures on the Affected Systems, and beginning June 30, 2024, we resumed processing transactions in the DMS. As of July 31, 2024, we regained access to all of the Affected Systems, including the CRM and inventory management applications. As a result of the CDK outage, our business and results of operations during the second and third fiscal quarters of 2024 were adversely affected. Although we have been working with CDK and other information technology vendors and taking steps to strengthen our systems infrastructure, and our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that another cyber incident would not materially affect our business strategy, results of operations or financial condition. See "General Risk Factors" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: Our third-party vendor risk management program addresses third party vendors with access to our systems or data, or who process data on our behalf, and includes a risk-based approach and security assessments throughout the third-party life-cycle, from onboarding to termination, as well as through contractual controls and technological controls to monitor the vendors' posture. This program is designed to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.

companyName: JFrog Ltd

ticker: FROG


text: Our cybersecurity risk management program contains eleven key elements: Information Security Policies, Strategic Planning, Risk Assessment, Audit and Examination, Business Continuity Planning, Incident Response Planning, Third-Party Due Diligence, Cyber Insurance Coverage, Employee Training and Testing, Patch and Vulnerability Management, and the Federal Financial Institutions Examination Council ("FFIEC") Cyber Assessment Tool ("CAT").

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the National Institute of Standards and Technology (NIST), as well as by engaging with experts to attempt to infiltrate our information systems (as defined in Item 106(a) of Regulation S-K).

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Ameren's board of directors maintains a standing committee, the Cybersecurity and Digital Technology Committee, that is dedicated to the oversight of Ameren's cybersecurity and digital technology risks. The committee has primary responsibility for oversight of cybersecurity and digital technology risk management, including the programs, policies, practices, controls and safeguards for digital technology, information security, prevention and detection of cybersecurity incidents and information or data breaches, and cybersecurity and digital technology matters as they relate to crisis preparedness, incident response plans, and disaster recovery and business continuity capabilities. The committee receives regular updates from the Chief Customer and Technology Officer, the Chief Information Officer, the Chief Information Security Officer, and other members of senior management regarding Ameren's cybersecurity program and key initiatives. The Cybersecurity and Digital Technology Committee regularly reports on its activities to Ameren's board of directors, including reviewing and advising Ameren's board of directors of any developments it believes should be considered.

companyName: AMEREN CORP

ticker: AEE


text: The Company's Board of Directors oversees our enterprise risk management ("ERM") program and has delegated the primary responsibility for its oversight, which includes oversight of cybersecurity risk, to the Audit Committee. The Audit Committee is informed of about material risks from cybersecurity threats through regular discussion with management regarding cybersecurity risk mitigation and cybersecurity incident management. Executive management, including our VPoC, regularly presents to the Audit Committee regarding cybersecurity matters, including program updates, key metrics, and developments.

companyName: TransDigm Group INC

ticker: TDG


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and to the Board through the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Our Board of Directors is responsible for risk oversight for the Company, which includes cybersecurity. Our Board of Directors risk oversight process, including for cybersecurity, builds upon management's assessment of the Company's risks and processes for managing and mitigating such risks. Our senior management presents a report to our Board of Directors at each of its quarterly regular meetings regarding our cybersecurity environment, relevant cybersecurity projects, actions we are taking to address and mitigate cybersecurity risks and other relevant cybersecurity related topics applicable to us. During such presentations and other discussions regarding risks, senior management reviews cybersecurity risks with our Board of Directors.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: To further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.

companyName: Lightstone Value Plus REIT V, Inc.


text: Trust underpins our mission and values and we believe that cybersecurity is important to our success. We are susceptible to a number of cybersecurity threats, including those common to most industries as well as those we face as a global media organization whose systems store and process confidential subscriber, user, employee and other personal and Company data. We, and third parties with which we work and on which we rely, regularly face attempts to breach our security and compromise our information technology systems from a broad range of actors. A cybersecurity incident impacting us or any such third party could disrupt our services, result in the compromise of confidential information; result in theft or misuse of our intellectual property; divert management's attention; require us to expend resources to mitigate the effects of such a security incident; subject us to litigation, regulatory or other government inquiries or investigations and/or liability; harm our reputation; or otherwise adversely affect our business, financial condition or results of operations.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to cybersecurity and privacy risks, and reviews information technology's program to monitor and assess information security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards and obtained a SOC 2 Type II report.

companyName: AUDIOEYE INC

ticker: AEYE


text: The Company's cyber risk mitigation plan is reviewed on a bimonthly cadence with a cross-functional Cyber Steering Committee, the managerial governing body that regularly reviews the top cyber risks and receives reports on progress on key cyber initiatives. T he Company's CISO leads the Cyber Steering Committee, which also includes individuals with experience identifying and managing enterprise risks, including the Company's President and Chief Executive Officer, Executive Vice President, Chief Financial Officer, Executive Vice President, General Counsel and Corporate Secretary and Vice President, Chief Audit Executive, as well as individuals with technical expertise in information technology, data governance and cyber matters and/or experience in managing cyber incident responses, including the Company's Executive Vice President, Chief Technology Officer, Vice President, Information Technology Operations and Senior Vice President, Deputy General Counsel and Chief Compliance Officer.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Our cybersecurity management team, lead by our CIO, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and reports produced by security tools deployed in the IT environment. Our CIO reports to the Company's Chief Executive Officer, as well as to the Board and Audit Committee. The CIO has served as our CISO for four years and has more than 20 years of experience in various roles involving managing cybersecurity functions, developing strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance. The CIO holds a bachelor's degree in computer science and various certifications which include Certified Ethical Hacker and Certified Chief Information Security Officer, and has 25-plus years of previous software and hardware systems engineering experience.

companyName: MasterCraft Boat Holdings, Inc.

ticker: MCFT


text: African Fintech industry, which is subject cybersecurity risks our business, of operations—including, but not the following: intellectual property risk and reputational risk. DSS") ("NIST")

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: The Company's cybersecurity risk management program is integrated into our overall enterprise risk management process and is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The program is comprised of a comprehensive set of policies and procedures designed to protect and identify threats to our Information Technology ("IT") systems and data, including those employed by our third-party service providers. Our dedicated cybersecurity team collaborates with business operations personnel as well as certain third parties, as applicable, to provide a comprehensive suite of cybersecurity services, encompassing network security, anti-malware solutions, email security measures, endpoint security, detection systems, application security, data safeguards, access management protocols, cybersecurity awareness initiatives, incident response strategies, threat intelligence, IT risk assessment and vulnerability management. We also maintain insurance coverage for cybersecurity incidents.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management and as part of our decision-making processes. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including but not limited to regular network and endpoint monitoring, vulnerability assessments, various system backups of all information, and through policy and procedure inform and train employees on the Company's underlying practices, and annual assessment and testing of such controls. Our information security function is responsible for identifying, assessing and managing cybersecurity threats and risks and works to monitor and evaluate our threat environment and risk profile.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please see Section 1A. Risk Factors.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Cybersecurity Governance InfuSystem maintains a dedicated cybersecurity governance framework. While senior management is primarily responsible for assessing and managing the Company's exposure to risk, our Board of Directors oversees our ERM, including cybersecurity risk management, and ultimately approves ERM policies and procedures. Our Board conducts much of its risk oversight activities, including cybersecurity risk oversight, through our Audit Committee. Given the ever-increasing volume of cyber threats and the magnitude of a potential breach, cybersecurity is a standing topic for the Board of Directors and Audit Committee.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: The Senior Vice President, Senior Technology Officer has 28 years of experience in information technology, with the last 13 as the information technology leader for the Bank. He holds a Bachelor's Degree in Computer Science. He is an active member of FS–ISAC's Mergers an Acquisition Working Group, and a named author of their 2023 "Cybersecurity Best Practices in Mergers, Acquisitions and Divestiture Deals" publication. He also serves as an advisory member of the Indiana Governor's Executive Council on Cybersecurity. He attends numerous industry training sessions including those put on by the SANS Institute, PaloAlto, Cisco, Microsoft, the Cybersecurity and Infrastructure Security Agency (CISA), and FS–ISAC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. The Board's Audit Committee routinely evaluates the Company's cybersecurity through communications with management and the Company's information technology department. Systems are in place to perform ongoing testing to defend and mitigate against unwelcome intrusions and attacks.

companyName: Rocky Mountain Chocolate Factory, Inc.

ticker: RMCF


text: We take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on the nature of the data accessed by the vendor. Currently, we review System and Organization Controls ("SOC") reports from vendors who have access to financial reporting information, and we are in the process of developing additional vendor risk management policies and procedures.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, International Organization for Standardization and the Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees, Board members and certain contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats and incident response preparedness, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct annual cybersecurity management and incident training for current employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management team. Our board of directors has delegated responsibility to the Audit Committee for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive regular updates from senior management, including leaders from our information technology, legal and compliance teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, information on how management is addressing and/or mitigating those risks, cybersecurity incidents (if any) and status on key information security initiatives.

companyName: uniQure N.V.

ticker: QURE


text: Our head of IT, in coordination and with support from our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the head of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our audit committee when appropriate.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: The Audit Committee of the Board of Directors oversees the Company's technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture on a regular cadence. In addition to this regular reporting, cybersecurity risks or threats may also be escalated to the Audit Committee on an as-needed basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery, escalation to senior management, the Board of Directors, and functional areas, and notification to customers and employees as appropriate.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Viewbix Inc.

ticker: VBIX


text: Our audit and risk committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit and risk committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit and risk committee provides regular updates to the board of directors on such reports.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: Emerson maintains a Cybersecurity Awareness Team, within the global enterprise security team, responsible for driving a global information security culture through awareness and education programs. It has created company-wide information security policies and procedures, reviews these regularly and makes them electronically available to our employees. The team works closely with subject matter experts to create educational material and communicate best practices to the company through online training, custom video content, simulated phishing attacks and a variety of other targeted touchpoints.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Regular assessments and reviews, through both internal and external experts, are conducted on OneStream information assets and networks, including systems, devices, applications, solutions and related computing resources, to evaluate potential risks and vulnerabilities, identify actions to be taken, and evaluate the effectiveness of our cybersecurity program. Risk management exercises occur regularly and in response to changes in Company operations, risk landscape, and threat actor activities, using tabletop exercises, threat modeling, risk forecasting, and other techniques to monitor and evaluate the sufficiency of our policies, processes and controls. Internal assessments occur based on results from risk management exercises, changes in infrastructure, cybersecurity risks, threat actor activity, and in response to other internal or external events. External assessments are conducted by third-party assessors, consultants or auditors, as relevant, and occur regularly in order to maintain our certifications and accreditations with certain compliance regimes (for example, FedRAMP). Additionally, the Company utilizes third-party software, services and providers in our cybersecurity program in furtherance of our security processes such as endpoint security, threat intelligence, cloud security, and authentication services.

companyName: OneStream, Inc.

ticker: OS


text: Device and Network Security Our device and network security policies and procedures are designed to mitigate risk by ensuring our network and computing devices ("Computer Equipment"), electronic systems, and resources used in our business ("Information Systems"), whether owned or leased by us, our employees, or third parties, and the Information Assets contained therein, are protected from security threats.

companyName: Clene Inc.

ticker: CLNN


text: The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all areas of the business. The cybersecurity risk management program is designed to align with industry best practices and has adopted the framework and measurement practices developed by the National Institute of Standards and Technology (NIST). In addition, the Company has implemented a cross-functional cybersecurity steering team to facilitate coordination across key departments and assists in defining policies, procedures, and mitigation strategies, and will be called on to assist in risk assessment of any threat or incident.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: The TRCC is used as a platform to assess risk and controls components across the information technology (IT) landscape including cybersecurity. It manages the risk assessment process, escalation and implementation of risk acceptance thresholds with the help of the GRC.

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: We believe that the conduct of our employees is critical to the success of our information security. Through our security awareness program, we keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes training intended to prevent the success of cyberattacks. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.

companyName: TEXTRON INC

ticker: TXT


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are informed by frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program addresses threats in a prioritized manner and, in particular, focuses on the following key areas: • gap analysis to identify programmatic opportunities for improvement that can be incorporated into the cyber strategy; • policies and standards that are annually reviewed and communicated; • exceptions management and internal audits that support cybersecurity requirements through assessing control implementation risks; and • monitoring and regular reporting of cyber resilience and posture at operational and strategic levels.

companyName: IPALCO ENTERPRISES, INC.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and ensuring the safety and efficacy of our medical devices. Our cybersecurity risk management program, which is based on recognized cybersecurity frameworks established by the National Institute of Standards and Technology ("NIST") and led by our Chief Information Officer (CIO), is fully integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. We are dedicated to maintaining the highest standards of cybersecurity to protect our customers and stakeholders. We will continue to adapt to evolving threats and regulations to ensure the safety and security of our products and information.


text: Engage Third Parties on Risk Management We engage a range of external experts, including cybersecurity consultants and auditors to evaluate and test our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements. Our cybersecurity programs generally align with the NIST Cybersecurity Framework, and third party audits on portions of our cybersecurity program or processes apply the NIST Cybersecurity Framework controls. These partnerships provide expert knowledge and insights, which are designed to ensure our cybersecurity strategies and processes are consistent with industry best practices.

companyName: Allegion plc

ticker: ALLE


text: Our strategy for managing cyber-related risks is risk-based and, where appropriate, integrated within our comprehensive enterprise risk management processes. Our Chief Security Officer (CSO), who reports directly to our Chief Technology Officer (CTO), leads a dedicated cybersecurity team and is responsible for the design, implementation and execution of our cyber-risk management strategy.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Our Board would be made aware of any material risks associated with cybersecurity threats. Our Board currently receives periodic updates from our CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Willow Tree Capital Corp


text: To date, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. For a description of the risks from cybersecurity threats that may materially affect NetScout and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: We have implemented and maintain a cybersecurity risk management program that includes processes designed for the identification, assessment and mitigation of cybersecurity risks in order to protect the confidentiality, integrity and availability of our critical systems and information. We have designed and assessed our program based on the Center for Internet Security (CIS) Controls standard and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: We interface regularly with a wide range of external organizations and participate in classified briefings to maintain an awareness of current cybersecurity threats and vulnerabilities. We utilize third-party consultants to evaluate and test our cybersecurity preparedness and participate in national transmission grid security exercises that also address cybersecurity threats. Our security efforts are intended to address evolving and changing cyber threats. We operate a dedicated cyber security center with capabilities to monitor, detect, analyze, mitigate, and respond to cyber threats.

companyName: Tri-State Generation & Transmission Association, Inc.


text: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: We have designed and assessed our program based on the Center for Internet Security Critical Security Controls (CIS Controls) and Safeguards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: As previously disclosed, we were targeted by a complex criminal scheme early in Fiscal 2024, which resulted in fraudulently-induced outbound wire transfers to a third-party account (see Note 18 to the accompanying consolidated financial statements). The Company promptly self-discovered the fraudulent activity and contacted the remitting bank, receiving bank, dispute resolution experts, and federal and local law enforcement authorities. Moreover, we quickly informed the audit committee and regularly provided them with updates during investigation and recovery efforts. As a result of the fraud loss, net with funds recovered, and professional fees incurred related to an independent forensic investigation and efforts to recover the funds, we recognized $2.7 million of loss. We are unaware of any other significant security breaches at any of our business locations.

companyName: ARGAN INC

ticker: AGX


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Rapid7, Inc.

ticker: RPD


text: The CTO and the Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks. The CTO keeps the CEO apprised of any noteworthy activity on an ongoing basis. The CEO in turn provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: Versus Systems Inc.

ticker: VS


text: In its oversight role, our board of directors considers risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Company operates in the biotechnology sector and is subject to various cybersecurity risks that could adversely affect the Company's business, financial condition or results of operations, including intellectual property theft, fraud, extortion, harm to employees, collaborators or vendors, violation of privacy laws and other litigations, legal and reputational risk.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: The Director, Cybersecurity has served in various roles in information technology and information security for over 24 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. The Director, Cybersecurity holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. The Director, Technology Compliance has served in various roles in information technology for 11 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. The Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 13 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.

companyName: YETI Holdings, Inc.

ticker: YETI


text: While management is responsible for the day-to-day handling of our risk management program, the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee, which is responsible for ensuring sufficient oversight of our cybersecurity risk exposures. The Audit Committee leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics. Senior leaders from our Information Security, Legal, Privacy, and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.

companyName: CARVANA CO.

ticker: CVNA


text: Our cybersecurity program is managed by our Director of Information Technology and Chief Operating Officer. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Director of Information Technology and Chief Operating Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Chief Financial Officer and our external IT team whose is responsible for leading enterprise-wide cybersecurity execution, protocols, framework, standards and processes. The Chief Financial Officer reports to our board of directors, as well as our Chief Executive Officer and other members of senior management as appropriate.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer and other senior executives are part of the notification chain.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems or those of our vendors could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: PLAINS ALL AMERICAN PIPELINE LP

ticker: PAA


text: We acknowledge the significance of cybersecurity in protecting our operations, data, and shareholders' interests, and have made cybersecurity a fundamental component of our overall risk management framework. Our cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This framework guides our efforts to protect critical assets, identify potential threats, respond to incidents, and strengthen resilience, while simultaneously allowing us to assess and enhance the maturity of our program. The cybersecurity program is informed by our Enterprise Risk Management ("ERM") process and relies on internal and external expertise. We proactively evaluate and refine our security controls by utilizing best practices and threat intelligence to mitigate cyber risks. The Company also utilizes third parties for some cybersecurity services, including managed security services, external penetration testing, and social engineering tests. Additionally, we maintain an incident response plan that aligns with industry standards to ensure timely detection, containment, and remediation of security incidents.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity. In 2023, the full Board also received a presentation from a third-party expert on cybersecurity risks.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: In connection with the ERM process, cybersecurity risks, including those relating to risks posed by our use of third-party service providers, are assigned to cross-functional management committees responsible for identifying and classifying the cybersecurity risks in accordance with our ERM risk rating methodology, and developing and administering risk mitigation and incident response plans. These cross-functional management committees regularly meet to review current and emerging cybersecurity risks and maintain policies and procedures governing the evaluation and classification of such risks.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: As such, Mr. Geldenhuys personally monitors cybersecurity events and logs for unusual activity or potential security breaches within the network. E-mail alerts are sent in real time as notification for any suspicious activity including phishing attempts, suspicious attachments, and other e-mail-related security concerns.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Our CISO supervises a team of cyber risk architects, engineers and managers who actively work to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means. Our cyber risk team collaborates with internal stakeholders to identify and analyze cybersecurity risks to the Company, implement appropriate controls and enable leaders to make risk-based business decisions that implicate cybersecurity considerations. Our CISO also reports on our cybersecurity and data privacy processes, procedures and risks to our executive management team when changes or risks are expected to impact other portions of the business, including with respect to the Wheels Up mobile app, website and proprietary pricing algorithms.

companyName: Wheels Up Experience Inc.

ticker: UP


text: To identify potential risks, Ambac or a third party vendor engaged by the Company also assesses the security measures of vendors and third-party service providers that have access to the Company's information systems and sensitive data. Each review involves an initial risk assessment of the provider, and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers' systems that could affect the Company, or to have cybersecurity incident notice requirements in their cybersecurity programs.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: We have developed and implemented a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: The Audit Committee and the Board of Directors oversee and periodically review the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans. On an established cadence, the Audit Committee and the Board of Directors are briefed by the Chief Information Security Officer ("CISO") on the status and progress of the cybersecurity program, as well as on direct or emerging threats to the Company, program maturity and strategy, and third-party risk management. Additionally, the Board of Directors receives ERM program briefings that include cybersecurity risks.

companyName: MSA Safety Inc

ticker: MSA


text: Our Advisor's information technology team is led by its Chief Information Officer who has extensive experience working with information security systems. Our Advisor's information technology team consists of individuals with expertise in assessing, preventing and addressing cybersecurity risk and is responsible for executing our cybersecurity program as well as communicating regularly with our Advisor's senior management, our Advisor's cybersecurity governance committee, the Audit Committee and the Board. Our Advisor's cybersecurity governance committee, comprised of the Advisor's Chief Financial Officer, Chief Legal Officer, Chief Information Officer, Head of Internal Audit and senior members of its information technology team, are responsible for developing and maintaining our cybersecurity policies and standards, monitoring ongoing compliance and program updates, and ensuring our information security is aligned with our business objectives and strategies under the oversight of our Board.

companyName: Net Lease Office Properties

ticker: NLOP


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cyber security events that may negatively impact us or our data.

companyName: Regional Management Corp.

ticker: RM


text: Our board of directors has formed a cybersecurity committee of the board to assist it in fulfilling its oversight responsibility with respect to the management of cybersecurity risks related to our products and services as well as our information technology and network systems. The responsibilities of the cybersecurity committee include overseeing our implementation and maintenance of cybersecurity measures, data governance, compliance with applicable information security laws, and overseeing disclosure controls relating to cybersecurity. The cybersecurity committee receives reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them and has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation. In addition, our audit committee has oversight responsibility over our internal financial controls and our enterprise risk management program. Finally, management periodically provides cybersecurity briefings to the entire board of directors.

companyName: Snowflake Inc.

ticker: SNOW


text: As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our advisor, our advisor is a subsidiary of DWS, and DWS is majority owned by Deutsche Bank. Deutsche Bank and its affiliates are collectively referred as Deutsche Bank Group. DWS aligns its information security management system to the latest information security policies defined by Deutsche Bank. The DWS Information Security Framework is managed under Deutsche Bank's framework. As such, we are reliant on Deutsche Bank Group for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details of the cybersecurity program applicable to Deutsche Bank Group.

companyName: RREEF Property Trust, Inc.


text: We maintain a cybersecurity incident response plan to help ensure a timely, consistent, and effective response to actual or attempted cybersecurity incidents impacting the Company. The plan includes considerations for (1) detection, (2) analysis, which may include timely notice to our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. In addition, we also maintain a formal information security training program for all employees that includes training on topics such as phishing and email security best practices. Employees are also required to complete regular training on data privacy.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: The Board has determined that retaining responsibility for risks related to cybersecurity oversight is appropriate, given the complexity of the risks associated with cybersecurity and the attention required to appropriately review and monitor such risks. The full Board lends its collective experience and attention to discussing and overseeing potential risks identified by management and stays up to date on management's risk-mitigation processes related to cybersecurity.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: CTO's cybersecurity processes and practices are integrated into CTO's risk management and oversight program. In general, CTO seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that CTO collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. CTO utilizes a third-party managed IT service provider (the "MSP") to provide comprehensive cybersecurity services for the Company, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery, and cybersecurity education and awareness. The Company has adopted a written information security incident response plan, which, as discussed below, is overseen by the Audit Committee of the Board (the "Audit Committee").

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluate and addresses cybersecurity risks in alignment with our business objectives and operational needs. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Winning Catering Group, Inc.

ticker: WNHK


text: Our management and board of directors (the "Board") recognize the importance of maintaining the capacity, reliability and security of our information technology environment and data security infrastructure to deliver on the expectations, and maintain the trust and confidence, of our customers, clients, business partners, employees and investors. The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management ("ERM") framework, in which cybersecurity risk management is reviewed by the board at least on an annual basis. Our cybersecurity and privacy programs align with the recognized frameworks established by the National Institute of Standards and Technology and leverage the International Organization for Standardization and other applicable industry standards. The focus of our cybersecurity program is preserving the confidentiality, security and availability of our systems and data, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: We have processes in place to assess, identify, and manage material risks from cyber security threats. The Company's business is dependent on the communications and information systems of Investcorp Group, of which the Adviser is a part. The Adviser manages the Company's day-to-day operations and has adopted a cyber security program that applies to the Company and its operations.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program as well as our cybersecurity risk identification program, both of which are discussed above and provided for in our Third-Party Cyber Risk Policy. The Third-Party Cyber Risk Policy sets guidelines for identifying, measuring, monitoring, and reporting the risk associated with third parties relationships, which includes planning, due diligence and third party selection, contracting, ongoing monitoring, and termination. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threats identified through such diligence.

companyName: Warner Music Group Corp.

ticker: WMG


text: Moreover, we remain committed to investing in the development and improvement of our security processes and controls, as well as maintaining our technology infrastructure. These processes include a plan for notifying, informing, consulting, analyzing, and communicating any risks or incidents to a range of internal stakeholders, including executive management and the Board of Directors, as well as external stakeholders, as deemed necessary and appropriate based on the circumstances. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Financial Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Digital & Technology Officer (CDTO).

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: We perform a formal risk assessment each year. As part of our risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: LiveOne, Inc.

ticker: LVO


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2023, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.

companyName: MOODYS CORP /DE/

ticker: MCO


text: b.we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer ("CTO") and supported by our Chief Information Security Officer ("CISO"), each of whom has expertise related to data and network security, data governance and risk management; c.we regularly test our internal IT controls; d.we regularly conduct internal vulnerability assessments as well as third-party penetration tests;

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, Information Security Officer and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory privacy requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Okta, Inc.'s management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security and technical personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our technical environment.

companyName: Okta, Inc.

ticker: OKTA


text: The CISO actively monitors developments in the area of cybersecurity and is involved in various related government and industry groups and briefs the Company's Board quarterly or as needed on relevant cybersecurity issues. The Utilities continue to make investments in their cybersecurity program, including personnel, technologies, cyber insurance and training of Utilities personnel.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: The Board is responsible for risk management, with specific oversight of cybersecurity risks being delegated to the Audit Committee. The Audit Committee receives updates from Tredegar's and Bonnell's IT Directors at each of its quarterly meetings. These updates encompass an assessment of Tredegar's cybersecurity risk profile, including the efficacy of Tredegar's cybersecurity policies, procedures, strategies, and areas of emerging risk. Additionally, the Board receives annual, but often more frequent, updates on Tredegar's cybersecurity systems.

companyName: TREDEGAR CORP

ticker: TG


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the information security committee ("Information Security Committee") in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly.

companyName: TransDigm Group INC

ticker: TDG


text: This includes all methods of data processing, transmission, and retention, both electronic and physical. Electronic Information Systems used by on behalf of the Trust must, at a minimum, adequately address security elements consistent with applicable state and local regulatory requirements and best practices pertaining to: Data Storage, User Access, and Data Transmission.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Management Oversight and Governance The Company's Chief Information Security Officer ("CISO"), who reports to the President, Software, is responsible for the design and implementation of our security program and strategy based on the mandate provided by the Board and senior management. The CISO has extensive experience in the management of cybersecurity risk management programs, having served in various leadership roles in information technology and information security for over 20 years, including serving as the Chief Security Officer of two other large public technology companies. We believe the Company's business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: FAIR ISAAC CORP

ticker: FICO


text: While we, along with our customers, vendors, suppliers, and service providers, are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate, has materially affected the Company during the periods covered by this report. See Item 1A, "Risk Factors", for more information on the cybersecurity threats facing our Company.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: We employ a range of tools and services to inform our risk preparedness, identification, assessment and remediation processes, including, among others, continuous monitoring, regular reoccurring security and compliance activities, training, threat intelligence, business processes, change management, strategic planning, annual assessments, and periodic testing and assessments performed by qualified security personnel and by third-party firms. As part of the above-described processes, we engage with third-party firms to perform independent assessments, including internal and external penetration tests, social engineering tests, configuration assessments, security plan and program assessments, compliance assessments, and incident response readiness exercises to help identify areas for continued focus, improvement and/or compliance.

companyName: USA TODAY Co., Inc.

ticker: TDAY