text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Adviser regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting or which are reasonably likely to impact the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: The Company's Internal Audit function conducts an annual Enterprise Risk Management process to identify, assess, monitor and control current and future potential risks facing the Company, which includes cybersecurity risks that are communicated by the Chief Information Security Officer ("CISO"). Significant risks identified during this process are then presented to the Audit Committee. In addition, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. We also routinely perform attack and response simulations at the technical level, and annually execute tabletop response exercises. Each year, special focus is given to maintaining and improving our alignment with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and Privacy and Payment Card Industry ("PCI") controls in support of protecting our technology and customer data. We further engage in the periodic assessment and testing of our cybersecurity program.

companyName: MGM Resorts International

ticker: MGM

secItem: Item 1C


text: The Company's chief executive officer ("CEO") and chief financial officer ("CFO") have primary responsible for cybersecurity risk management and the implementation of processes for identifying, assessing, and managing material risks from cybersecurity threats. Officers of the Company and its Australian subsidiary review, at least quarterly, developments relevant to the Company's cybersecurity control environment. This group of officers has experience managing public companies and overseeing internal controls associated with cybersecurity. Additional support for IT general controls and specific cybersecurity matters is provided to the Company through third-party IT specialists. Per the Company's policies, including its Disclosure Policy and Code of Business Conduct and Ethics, cybersecurity incidents are to be immediately reported to the Vista management team for resolution. Information technology general controls, including controls to mitigate cybersecurity risks, are considered by management during their assessment of the Company's design and effectiveness of internal controls over financial reporting. Findings from these control procedures are considered by management and, as deemed appropriate to reduce cybersecurity risks to an appropriately low level, are implemented. This may include modification of internal control procedures, adoption of technology solutions, and testing of specific elements of the system of controls.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Identified risks are evaluated and assessed by the Company's security review council, comprised of various security, technology, and privacy staff members and management. A member of management is assigned as the risk owner and takes an active role in managing the risk, including determining the risk response and risk treatment plan, as well as participates in assessing any residual risk. Our Chief Information Security Officer oversees our cybersecurity risk management program.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We use third-party security firms to assist us in performing assessments annually and penetration testing regularly throughout the year on our applications, networks, and environments. We perform an annual review to verify our compliance with the Payment Card Industries Data Security Standards ("PCI DSS").

companyName: QXO BUILDING PRODUCTS, INC.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats.

companyName: Western Uranium & Vanadium Corp.

ticker: WSTRF


text: Our CDTO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CDTO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, at least annually. Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: As part of our risk management system, we also periodically provide company-wide cybersecurity training to our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our General Counsel, Chief Financial Officer, Head of IT, other internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Atai Beckley N.V.

ticker: ATAI


text: We have implemented processes designed to minimize the chance of a successful cyberattack and we have also established incident response procedures to address a cyber threat that may occur despite these safeguards. Pliant's Cybersecurity Incident Response Plan includes engagement with key vendors, industry participants, and intelligence and law enforcement communities which are a fundamental aspect of our strategy. The Response Plan addresses (1) detection, (2) analysis, (3) communication, (4) containment, (5) eradication, (6) recovery and (7) post-incident review.

companyName: PLIANT THERAPEUTICS, INC.

ticker: PLRX


text: As a critical element of our overall ERM approach, our cybersecurity program is focused on the following key areas:

companyName: PROS Holdings, Inc.


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards of Technology ("NIST") Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate Information Technology ("IT") systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Our committee for the review and implementation of cybersecurity policies and procedures are made up of the CEO, CSO and VP of Regulatory and through the CEO, provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

companyName: ADM TRONICS UNLIMITED, INC.

ticker: ADMT


text: The Company approaches cybersecurity as an enterprise-wide risk and uses external resources to assess risk and manage its IT and 24x7 cybersecurity operations, including managed service providers who assist in the support of key business systems. The Company may also periodically engage external consultants to assist with cybersecurity incident management, particularly where advanced or specialized expertise may be required. If a material cybersecurity breach occurs, the incident will be reviewed by management to determine whether further escalation is appropriate. The Executive Chairman of the Board and Chief Executive Officer and the Chief Financial Officer have primary responsibility for this review and assessment. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive team, and if deemed necessary or appropriate, the Board of Directors. The Board Audit Committee is responsible for reviewing and discussing the adequacy and effectiveness of the Company's information security policies and the procedures and controls regarding information systems. In addition, we plan to consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and to assist in making the final materiality determination regarding disclosure and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents as appropriate.

companyName: Catheter Precision, Inc.

ticker: VTAK


text: We have a NIST enclave Cybersecurity Incident Response Plan ("CSIRP"), but do not currently have a company-wide CSIRP to provide the organizational and operational structure, processes, and procedures for investigating, containing, documenting and mitigating cybersecurity incidents. We expect to further implement a risk-based approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also further implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: VirTra, Inc

ticker: VTSI


text: Management's Involvement in Cybersecurity Risk Oversight Our CISO continues to enhance our cybersecurity program and leads our efforts to mitigate technology risks in partnership with business leaders. Our CISO conducts regular reviews of the control environment and identifies those risks within the Enterprise Risk Management process to assess, monitor and control current and future potential risks facing the Company. Our CISO has over 20 years of expertise in technology, cybersecurity, information security risk management, incident management and response and privacy and has held various roles in information security throughout his career. The CISO holds various professional certifications, including Certified Information Security Manager certification from the Information Systems Audit and Control Association and Certified Incident Handler from the International Council of E-Commerce Consultants. The CISO holds a Bachelor of Science Degree in Cyber Security & Information Assurance.


text: As part of our risk management processes, we perform risk assessments in which we map and prioritize information security risks identified through the processes described above, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude. These assessments inform our risk mitigation strategies, which are reviewed regularly with the Board and management, and we view information security risks as one of the key risk categories we face. For example, our information technology and infrastructure has experienced and may in the future be vulnerable to cyberattacks (including ransomware attacks) or security incidents, and third parties have in the past and may in the future be able to access proprietary business information, and personal data that we collect, store and process. For more information regarding the information security-related risks we face, see the information in "Item 1A: Risk Factors" under the caption "We have been and may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results".

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Impact on Results of Operations or Financial Condition Cybersecurity risks and incidents have not materially affected our results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: We use various tools and methodologies to identify, manage, and test for cybersecurity risk on a regular cadence both at the enterprise level and using third party service providers. These third parties include cybersecurity managed security service providers (MSSPs), consultants, advisors, and auditors, who we engage to evaluate our controls, whether through penetration testing, independent audits, or consulting on best practices to address new threats or challenges. We also actively engage with key vendors, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and improve our program. Internally, our employees are a key part of our program. All employees are required to complete cybersecurity training at least once every year, and employees in certain roles must complete additional, specialized cybersecurity training on a regular basis.

companyName: BRUNSWICK CORP

ticker: BC


text: The Company requires information security education, training at the time of hire, and annually thereafter, by its employees (including contractors and other third parties for training purposes), designed to mitigate accidental information security incidents. Phishing simulation activities are regularly conducted to assess employees' competency at identifying potential threats. Employees are assigned incremental training requirements should they fail to identify simulated phishing emails through the initial training.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Oversight of cybersecurity risk is provided by our Board of Directors, which receives regular updates from management regarding cybersecurity matters. Management responsibility for cybersecurity is assigned to our Vice President of Services, who reports to senior leadership and the Board on a regular basis.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Blackstone has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors, including those of companies externally managed by Blackstone such as BREIT. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of Blackstone data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Blackstone may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Blackstone seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing its requirements and industry best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Blackstone also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: As part of our risk management program, we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Jamf Holding Corp.

ticker: JAMF


text: The Company has processes in place for assessing, identifying and managing risks from potential cyber threats and vulnerabilities. To protect the Company's information systems from cyber threats, the Company uses a variety of tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and/or remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities affecting information systems and data.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: c. Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.

companyName: Axogen, Inc.

ticker: AXGN


text: Georgia Transmission and Georgia System Operations provide us with certain transmission and system operations services that enable us to deliver energy to our members. As part of our risk management approach, we coordinate our cybersecurity preparedness and response planning with Georgia Transmission and Georgia System Operations.

companyName: OGLETHORPE POWER CORP


text: Our Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding significant cybersecurity incidents.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: In our business, we recognize the risk that cybersecurity threats pose to our operations, and as such, cybersecurity is an important component of our overall risk management strategy. We have adopted and implemented an approach to identify and mitigate cybersecurity risks utilizing the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guideline to help management identify, assess, reassess, and manage cybersecurity risks. We have developed and implemented cybersecurity programs and processes, including risk management and assessment programs, network segmentation, deployment of detection tools across our network, systems and databases, security and event monitoring capabilities, a detailed incident response plan and an incident response team. Our incident response team is led by our Chief Information Officer, who has over 23 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies, and also includes our General Counsel and our Chief Financial Officer. We conduct an initial assessment on the cybersecurity profile of our third party vendors as they are onboarded and evaluate their cyber security programs and safeguards before allowing them access in our environments. We utilize cyber intelligence to provide continuous monitoring and scanning of systems to provide awareness if any of our vendors have security incidents. Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services to maintain certain security protections including compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including storage, transmission, and access. We have implemented advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate threats. We provide at least quarterly company-wide cybersecurity information training and routinely communicate with employees about the potential for cybersecurity threats. We additionally deploy technical safeguards that are designed to protect our information systems from cybersecurity threats including firewalls, intrusion penetration and detection systems, anti-malware functionality and access controls, vulnerability assessments and cybersecurity threat intelligence. We continuously monitor and assess our information technology and data assets to detect anomalies and to respond quickly to threats that may arise. In certain instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments, information security program assessments and external threat environment reviews.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: The Company takes data protection seriously and ensures employees understand their role in keeping the Company safe from cyber-attacks. We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or to our systems. Third-party risks are included within our broader overall risk assessment and management process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers during vendor onboarding and during periodic reviews. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and regularly monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or independent information security assessments or certifications. Additionally, we have processes designed to monitor public and federal government database and other sources for evidence of known and/or exploited vulnerabilities in third-party services including those provided as SaaS and we take action to remediate or establish compensating controls if those systems are determined to be critical to our cybersecurity. We also maintain disaster recovery plans in place for all mission critical parts of the business, although we do not have a business continuity plan developed to account for all continuity risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable, to the board of trustees of the Company. Annually, key elements of the Cybersecurity Program are subject to review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.

companyName: North Haven Net REIT


text: The CISO and other members of the IT security team actively participate in maritime-specific as well as other broader cybersecurity groups for collaboration on cyber resilience, threat intelligence sharing, and best practices exchange. All the members of the IT security team regularly undergo new training/certifications on cybersecurity and attend seminars/conferences related to cybersecurity to keep their knowledge and expertise current. The CISO meets with the Chief Executive Officer of the Company monthly, and more frequently if warranted, to provide updates on cybersecurity programs, threats, and incidents.

companyName: International Seaways, Inc.

ticker: INSW


text: As the Company's Executive Vice President, Transformation and Chief Information & Digital Officer, N stor Cano has served in several leadership positions at both the Company and Sprint, including as Sprint's Chief Operating Officer, overseeing, among other things, Sprint's digital architecture and delivery. Mr. Cano studied industrial engineering at Barcelona Polytechnic University, attended the Executive Distribution Academy by INSEAD Business School in Fontainebleau, France, and also completed his post-graduate degree in executive management at IESE Business School in Barcelona, Spain.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the ELT and the FactSet Audit Committee, and, where appropriate, the Board of Directors (the "Board"). We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot eliminate all risks from cybersecurity threats, or provide assurance that our operations, business strategy, results of operations, or financial condition will not be materially affected in the future by such risks or any future material cybersecurity incidents. For additional information about our cybersecurity related risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, and the Chief Executive Officer. The Company's information technology department and managed service partners work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors and the chair of the board of directors for certain cybersecurity incidents. The audit committee of the board of directors receives summaries or presentations from the Vice President, Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: Vor Biopharma Inc.

ticker: VOR


text: Our Chief Information Security Officer ("CISO"), along with the information security, engineering, and legal functions at the Company, help identify, assess, and manage the Company's cybersecurity threats and risks. They work to identify and assess risks from cybersecurity threats by monitoring and evaluating the threat environment using various methods including manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, conducting audits and threat assessments, conducting vulnerability assessments, and external threat intelligence.

companyName: PagerDuty, Inc.

ticker: PD


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts. We may implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats. We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services. The risk management and reduction measures we implement, depending on the computing environment or system, may include the following: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, disaster recovery/business continuity plans and clear desk policies; threat detection and incident response; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards and certifications; credit and background checks on our personnel and contractors; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; continuous monitoring for potential intrusions; vendor risk management program; employee security training; penetration testing; cyber insurance; and a dedicated cybersecurity staff and officer.

companyName: Cardlytics, Inc.

ticker: CDLX


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, risk assessments for each vendor, reviewing certain vendors' security assessments and written information security programs, the imposition of information contractual obligations, and, in certain instances, security assessment calls with select vendors' security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including providing third-party attestations of compliance with certain cybersecurity frameworks, such as SOC2 or ISO 27001.

companyName: Definitive Healthcare Corp.

ticker: DH


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, sharing common methodologies and governance processes across the enterprise risk management program. Specifically, our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and enterprise information technology ("IT") environment; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • cybersecurity internal and external penetration testing.

companyName: NOVANTA INC

ticker: NOVT


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions. See " Risk Factors - Security breaches and attacks on our computer systems could lead to significant costs and disruptions that could harm our business, financial results and reputation ".

companyName: TSS, Inc.

ticker: TSSI


text: Assessing, identifying, monitoring, and managing cybersecurity-related risks are included in our overall risk management processes. Cybersecurity-related risks are included in the population of risks that are evaluated to assess top risks to the Company on an annual basis. To the extent a heightened cybersecurity related risk is identified, risk owners will be assigned to develop risk mitigation plans, which are then tracked to completion. An annual risk assessment is presented to the Board.

companyName: RideNow Group, Inc.

ticker: RDNW


text: To date, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion regarding risks related to cybersecurity threats, refer to Item 1A. "Risk Factors" of this Form 10-K.

companyName: Sonos Inc

ticker: SONO


text: The Committee receives reports at least annually from our Chief Technology Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We have not identified any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: Cerevel Therapeutics Holdings, Inc.


text: The Company has processes in place to identify, assess and manage risks from information security vulnerabilities and cybersecurity threats. The Company maintains and updates tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities that may affect the Company's information systems and data. The Company uses an enterprise vulnerability management platform to scan IT assets and report any known vulnerabilities associated with such IT assets. This platform enables the Company's Information Security Team to identify and prioritize solutions necessary to remediate any identified vulnerabilities. The Company's policies require that remediation be performed in a timely manner, including the completion of follow-up scanning to confirm the remediation of any identified vulnerabilities. Further, the Company's incident response program enables the identification and management of information security threats, risks and incidents. The incident response program is powered by technology that enables threat and event correlation across enterprise systems, user behavior analytics, anomalous behavior identification, network detection and response, end point detection and response, and an incident tracking system. The Company promptly engages the Computer Security Incident Response Team ("CSIRT") if a security incident is observed. The CSIRT is composed of lead personnel from the Company's IT department and employees who have been trained on the handling of information security incidents. The CSIRT may also engage third party incident response investigators that are on retainer to assist in incident response.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: Our Board is actively engaged in the oversight of Synovus' information security risk management and cybersecurity programs and has delegated primary oversight of cybersecurity to our Risk Committee. The Risk Committee receives quarterly updates from the Company's CISO on the Company's information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness, and cybersecurity risk assessments. As a part of these quarterly updates, the CISO updates the Risk Committee on the development of any new or emerging cyber risks or threats and the appropriate mitigation actions. In addition, the Risk Committee annually approves the Company's information security program as part of its oversight of information risk, aligning our cyber risk exposure with our strategic objectives.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Third parties also play a role in our cybersecurity risk management and strategy. We contract with a third-party cybersecurity incident response team to assist in the management of cybersecurity threats. We also engage and rely on third-party cyber and information security providers for cybersecurity applications and infrastructure to protect our network, systems and data.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cyber risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyber attack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cyber security incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board"). To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Lucid has also implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.

companyName: Lucid Group, Inc.

ticker: LCID


text: Beyond technologies, processes, and controls, the Company's cybersecurity program also includes exercises designed to sustain a high level of awareness and readiness across its employee base of the risks that threat actors pose to the Company. Whether it is through the Company's monthly company-wide cyber training; its frequent in-house phishing exercises, regular tabletop exercises with the Company's Board of Directors, management, and employees; or its annual cyber business continuity planning sessions, the Company strives to provide education so its employees can be a positive force in the protection of the Company's systems.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: Independence Contract Drilling, Inc.


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected security breaches and notify users determined to be affected and applicable regulators of a breach where we are legally required to do so.

companyName: Unity Software Inc.

ticker: U


text: Our General Counsel was a corporate and securities lawyer at Wilson Sonsini Goodrich & Rosati, P.C., where he represented venture-backed technology and life sciences companies through all stages of growth. Additionally, he has played a critical role in building Recursion's public company compliance and corporate governance structure.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: The Trust's cybersecurity risk management program is overseen by the Executive Committee of the Managing Owner. Periodically, the Chief Information Security Officer of the Managing Owner provides an update to the Executive Committee of the Managing Owner on the Trust's cybersecurity threat risk management and strategy processes, including potential impact on the Trust, the efforts to manage the risks that are identified, and the Trust's disaster recovery preparations.

companyName: Frontier Funds


text: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank's security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments. The Information and Cyber Security Policy and Program establishes the additional policies and standards the Bank is required to implement in support of these practices and processes. Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts and law enforcement, along with documentation of regulatory notification requirements. Our practices are interdependent with third party vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: In addition, we engage and work with a range of third-party advisors, including cybersecurity consultants, legal counsel, and auditors, to help us assess, test, and otherwise assist in the development and review of our cybersecurity processes. These relationships enable us to benefit from specialized knowledge and insights to help inform our cybersecurity strategies.

companyName: ROSS STORES, INC.

ticker: ROST


text: Our cybersecurity operations team manages all facets of cybersecurity monitoring, coordinating with managed services security providers and internal analysts across the Company. All employees are provided cybersecurity awareness training, which includes topics on our policies and procedures for reporting potential incidents. Our cybersecurity team is continuously evaluating emerging risks, regulations, and compliance matters and updating the applicable policies and procedures accordingly.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.

companyName: Sharplink, Inc.

ticker: SBET


text: The Board receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from the Company's information systems manager. The Board also receives briefings from management on the cybersecurity risk management program as needed.

companyName: VPR Brands, LP.

ticker: VPRB


text: We consider cybersecurity as part of our broader consideration of business strategy and enterprise risk management. Our board of directors has delegated to the Audit Committee the responsibility of overseeing our risk management program, including for the cybersecurity program. The Audit Committee receives quarterly updates from our CIO with respect to the cybersecurity program. As part of its oversight, the Audit Committee may, for example, receive updates regarding assessments of our alignment with certain industry cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, results of penetration testing, revisions to the CSIRP, business continuity plans, and threat assessments.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: The Security Committee, which is composed of our independent directors and chaired by our chief product and technology officer, facilitates our board of directors' responsibility for oversight of security matters, including product security, data security, cybersecurity, security risk management, risk exposure and related controls and enterprise risk management related to these risks. The Security Committee reports regularly to the Board following meetings of the Security Committee with respect to its review and assessment of security matters and other matters that are relevant to the Security Committee's discharge of its responsibilities. The Security Committee meets quarterly to review with our vice president acting as chief information security officer and other members of management, which may include our chief executive officer, chief product and technology officer, chief financial officer, and general counsel, our cybersecurity programs, cybersecurity risks, mitigation or remediation strategies, and other matters impacting the committee's responsibilities.

companyName: Palo Alto Networks Inc

ticker: PANW


text: Risk Management and Strategy U. S. Steel maintains robust processes for identifying, assessing, and managing material risks from cybersecurity threats. U. S. Steel's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, led by the Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Senior Vice President – Business Development and President, USSE, the Vice President & Chief Information Officer (the "CIO") and the Chief Information Security Officer (the "CISO"). Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. U. S. Steel works closely with its internal and external auditors to assess, plan for, prevent and mitigate cybersecurity risks.

companyName: UNITED STATES STEEL CORP


text: The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, including the management of risks arising from cybersecurity threats. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation's approach to cybersecurity risk management with the Corporation's CISO.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: Our Board of Directors is responsible for overseeing the Company's cybersecurity risk management and be informed on risks from cybersecurity threats. The Board shall review, approve and maintain oversight of the disclosure (i) on Form 8-K for material cybersecurity incidents (if any) and (ii) related to cybersecurity matters in the periodic reports (including annual report on Form 10-K) of the Company. In addition, our management team, including those with experience in dealing with confidentiality-related cybersecurity issues, oversee and manage cybersecurity related matters and formulate policies as necessary. Our Board review on an annual basis regarding assessment, identification and management on material risks from cybersecurity threats happened in the ordinary course of our business operations. If a cybersecurity incident occurs, our Board will promptly organize relevant personnel for internal assessment and, depending on the situation, seek the opinions of external experts and legal advisors. If it is determined that the incident could potentially be a material cybersecurity event, our Board will decide on the relevant response measures and whether any disclosure is necessary. If such disclosure is determined to be necessary, such disclosure material will be prepared and reviewed by our Board before it is disseminated to the public.

companyName: CHINA PHARMA HOLDINGS, INC.

ticker: CPHI


text: Following the conclusion of an incident, we, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and incident response plan, identify potential adjustments as appropriate and report to our senior management and our Audit Committee on these matters.

companyName: W. P. Carey Inc.

ticker: WPC


text: The Company is committed to safeguarding its information systems and data against evolving cybersecurity threats. With operations spanning traditional publishing and the technology-driven Journal Technologies segment, the Company prioritizes robust cybersecurity measures to protect its operations, customers, and stakeholders. The Company employs a comprehensive cybersecurity risk management framework to identify, assess, and address risks that could impact business operations, sensitive client data, and the Company's portfolio of marketable securities. This framework incorporates: Technology Solutions: Prioritizing the security of Journal Technologies' court and justice software systems, which manage critical data and workflows. Traditional Business: Protecting the systems and data supporting the Company's publishing and printing operations. Financial Portfolio: Securing systems and processes related to the management of the Company's substantial marketable securities portfolio.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: Our CSO reports to our General Counsel and has principal executive responsibility and oversight for the Company's strategy, planning, and operations on the management of both physical and cybersecurity risk. Our CSO has extensive cybersecurity and program management experience and previously served in relevant leadership positions at another large multinational corporation and the U.S. Department of Defense. He is supported by our Chief Information Security Officer, who has extensive cybersecurity experience in both the private and public sectors, and a team of cybersecurity professionals with relevant and expansive educational and industry experience.

companyName: Dell Technologies Inc.

ticker: DELL


text: We carry insurance that provides protection that may reduce the potential losses arising from a cybersecurity incident. Risks from cybersecurity threats, including as a result of past cybersecurity incidents have not materially affected and are not reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.

companyName: JBT MAREL Corp

ticker: JBTM


text: We have developed and implemented a cybersecurity risk management program that is designed to assess, identify, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical systems and information. These processes are managed and monitored by our information technology team, which is led by our Vice President, Information Technology & Facilities, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting our data and information technology environment. For example, we conduct cybersecurity audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, CROs, and other contractors and suppliers. We also conduct periodic employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: As described above, ACRES has engaged a third-party IT firm and cybersecurity compliance consultant to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. ACRES management team oversees the work of the third-party IT and cybersecurity compliance consultant and regularly communicates with members of the team. Through the policies and controls described above, including an incident response policy, representatives of the third-party IT firm as well as members of ACRES management team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our customer transactions" and "Our business may be adversely affected by security breaches at third-parties." in Item 1A- Risk Factors.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We face a multitude of increasing cybersecurity threats, including those that target the Nation's critical infrastructure sectors. Reliable service and operational continuity are critical to our success and the welfare of those we serve, including our ability to safely and reliably deliver energy to our customers through our transmission, distribution, and generation systems. We are committed to maintaining robust governance and oversight of these risks and to investing in the implementation of mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks in an everchanging landscape.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Third-Party Service Provider Oversight: Our oversight processes include comprehensive due diligence checks for any new third-party service provider and continuous monitoring of our existing MSP firm's activities. We have established protocols for communication and incident response that align with our managed service provider's operations, and industry best practice, ensuring swift action in the face of cybersecurity threats. Furthermore, a scheduled series of meetings has been established to procure updates and deliberate upon cybersecurity strategy with our contracted third-party providers.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Company has a cross-functional cybersecurity incident response team ("CIRT"). The Company's CIRT routinely reviews and updates our incident response plans, procedures and protocols, as well as reports to the Company's RMC on security matters that impact the confidentiality, integrity, or availability of the Company's data or information systems.


text: Additionally, we have policies and procedures in place to help oversee and identify material risks from cybersecurity threats associated with third-party service providers. Prior to engaging vendors, specifically those involved in the processing, storage or transmission of certain data, the information security team completes a due diligence process, including requiring proof of the potential vendor's PCI, HIPPA, HITRUST, and/or SOC 2 compliance, as applicable. During the due diligence process the information security team assigns a risk ranking as it relates to information security risk and may perform additional due diligence if appropriate based on such ranking. Further, we engage an external vendor risk monitoring and alert service to monitor the cyber health of our third-party vendors. If there is a change in the vendor's risk profile, we review the risk and initiate an action plan in response, which could include additional monitoring, remediation requests or termination. If the vendor is a key technology vendor and/or a vendor with access to protected data, any action plan will be escalated to the CISO and require the CISO's approval before proceeding.

companyName: WEX Inc.

ticker: WEX


text: Our Chief Information Security Officer reporting to our Chief Information Officer as well as the Chief Financial Officer has 30 years of information technology experience with eleven of those years working in the cybersecurity field as both an engineer and a director. The Chief Information Security Officer has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Board of Directors on a regular basis. These updates contain information such as key performance indicators, National Institute of Standards and Technology ("NIST") Cybersecurity Framework status, cybersecurity road map status, and current events and issues.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents. Once an incident meets certain criteria, the Company's Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident. The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident's materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.

companyName: ARIZONA PUBLIC SERVICE CO


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Monitoring external and internal threats and events, managing access, facilitating use of appropriate authentication options, validating controls and programs by internal teams and independent third parties and testing various compromise scenarios that are overseen by our information security team;

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the " Committee ") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. The Company has not experienced a cybersecurity breach or information security breach during the past four fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: In Fiscal 2024, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see "Risk Factors—Risks Related to our Business and Industry" in this Annual Report on Form 10-K.

companyName: OPEN TEXT CORP

ticker: OTEX


text: Third-Party Cybersecurity Measures In part, we depend on the reliability of certain tested third parties' cybersecurity measures, including firewalls, virus solutions and backup solutions. Our business may be affected if these third-party resources are compromised.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: We have standing engagements with incident response experts and external counsel, including through our cyber insurance. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange intelligence about potential cybersecurity threats, best practices and trends. We continuously monitor and collect insights on the latest vulnerabilities and attack patterns (TTPs) released by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST).

companyName: Zedge, Inc.

ticker: ZDGE


text: The scale, scope, and complexity of our business raises a multitude of interdependent risks, which can vary over time. A primary responsibility of our leadership team, subject to oversight by our Board of Directors and specifically, our Board's Technology Committee, is to design and implement processes to identify, prioritize, assess, monitor and manage enterprise-level risks associated with cybersecurity threats. We have a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the cybersecurity risk landscape.

companyName: SYSCO CORP

ticker: SYY


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the heading "If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants with whom we work, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: Key elements of our cybersecurity risk management program include, but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Atai Beckley N.V.

ticker: ATAI


text: The Company considers the following factors in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and degree of risk; potential impact, if a risk materializes; and the feasibility, cost and impact of controls. The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, cyber insurance, and physical security controls. The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.

companyName: IBEX Ltd

ticker: IBEX


text: The Company's Cybersecurity team, led by the Company's Chief Information Security Officer ("CISO"), works in close partnership with multiple internal constituencies to monitor and focus on current and emerging data security matters across the Company and with third parties while implementing and enabling industry-accepted cybersecurity risk management and compliance frameworks and programming, including the NIST Cybersecurity Framework. Internal and third-party risks are reviewed, monitored, and managed by the Company's Cybersecurity and Privacy teams, audited by an Internal Audit team and various external parties. The Company regularly engages third-party experts to assess the effectiveness of its cybersecurity programs. Additionally, the Company continually invests in skilled personnel; recurring training, processes, and procedures; insurance coverages; and numerous technologies to keep pace with current threats; trends; and an ever-evolving legal, regulatory, compliance, and risk landscape with respect to cybersecurity.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: Cybersecurity Incident Response Process We maintain and regularly update a cybersecurity incident response plan that outlines the steps we take to identify, investigate and take action in response to any potentially material cybersecurity incidents. Our incident response plan is designed to ensure that our Director of Information Systems and members of our senior management team are timely informed of and consulted with respect to any potentially material cybersecurity incidents.

companyName: ELUTIA INC.

ticker: ELUT


text: To further reduce the residual risk associated with cybersecurity, we maintain Miscellaneous Professional Liability Insurance, which provides coverage for cybersecurity incidents. The deductible limits on these policies are determined by a corporate insurance risk management group and executive management at least on an annual basis. This group determines appropriate coverage levels and deductibles for each policy based on tolerance and weighs the coverage against the premium for the policy.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: In order to help protect us from any related cybersecurity vulnerabilities, we take a risk-based approach to the evaluation of third -party providers with whom we engage and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the third -party service provider's programs.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: Our CIO and CISO oversee our cybersecurity preparedness. Our CIO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining MicroStrategy in 2018. Our CISO, who joined MicroStrategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CIO.

companyName: Strategy Inc

ticker: MSTR


text: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Autoliv utilizes the National Institute of Standards and Technology ("NIST") Cybersecurity Framework in combination with other corresponding and partially mandated frameworks to guide cybersecurity risk management. This approach includes the identification, assessment, response, and management of risks arising from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our business, data and information systems. The Company contracts with third parties to assess Autoliv's cybersecurity program relative to its peers, utilizing the NIST framework as a baseline. Furthermore, Autoliv is pursuing, under TISAX (Trusted Information Security Assessment Exchange), an assessment and exchange mechanism for information security in the automotive industry, as well as compliance with road vehicle cybersecurity requirements as applicable to the supply chain under ISO 21434.

companyName: AUTOLIV INC

ticker: ALV


text: On a quarterly basis either the audit committee or the full board of directors receive information regarding our cybersecurity risk management from our Global Security Organization and from a representative of our Chief Product Officer's organization. The chair of the audit committee also updates the full board of directors on specific topics that are presented or discussed at the regular meeting of the audit committee.

companyName: Informatica Inc.

ticker: INFA


text: We incorporate assessment of our cybersecurity risk management and strategy into our overall management of enterprise risk. The Company evaluates cybersecurity threat risk areas across its business including, but not limited to, operational risk, fraud, harm to employees or third parties, patient safety and violation of privacy or security-related laws or regulations. The Company has a Compliance Committee that is responsible for overseeing the enterprise risk management process. As part of our efforts to mitigate cybersecurity threats, we have implemented cybersecurity processes, technologies, and controls designed to effectively identify and manage potential material cybersecurity threats.

companyName: AGILE THERAPEUTICS INC


text: Our cybersecurity program focuses on all areas of our business, including cloud-based environments, devices used by employees and contractors, facilities, networks, applications, vendors, disaster recovery, business continuity and controls and safeguards enabled through business processes and tools. We continuously monitor for threats and unauthorized access. We learn of security threats through automated detection solutions as well as reports from users and business partners. We draw on the knowledge and insight of external cybersecurity experts and vendors and employ an array of third-party tools to secure our information infrastructure and protect systems and information from unauthorized access.

companyName: TENAX THERAPEUTICS, INC.

ticker: TENX


text: We maintain a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity and availability of our information systems. Dedicated security and information governance and compliance professionals administer the program with oversight by our senior management team.

companyName: AECOM

ticker: ACM


text: While we have not experienced significant information security, cybersecurity, or data privacy incidents to date, we operate in an industry with high-value data related to cannabis products, strain genetics, and consumer preferences. If we, our vendors, or other third parties with whom we do business experience significant information security, cybersecurity, or data privacy incidents or fail to detect and appropriately respond to significant incidents, our business operations could be severely disrupted and we could be exposed to costly government enforcement actions and private litigation. In addition, our customers could lose confidence in our ability to protect their information, stop using our authentication services or participating in our rewards programs, or cease doing business with us altogether. Any of these outcomes could adversely affect our reputation, results of operations, and financial condition.

companyName: GROOVY COMPANY, INC.


text: We also have a cybersecurity incident response plan and procedures to manage cybersecurity incidents. These procedures include steps to identify, classify, communicate, contain, eradicate, and recover from a cybersecurity incident. These procedures also include notification to a cross-functional management team to assess incident materiality and an escalation process to members of our senior management team and our Board of Directors.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: In addition, our cybersecurity IRP is part of our overall Information Security Program, which is led by the Company's Information Technology ("IT") Vice President ("VP") and Chief Information Security Officer ("CISO") and is overseen by the Company's Chief Financial Officer ("CFO").

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: TMCC's cybersecurity program is administered by our Chief Information Security Officer. We believe our Chief Information Security Officer and our information security team have the appropriate expertise, background, and depth of experience to manage cybersecurity and data privacy risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, information security leadership roles, military experience, academia, ongoing internal and external training, and regular discussions with consultants and industry peers with applicable knowledge and expertise regarding emerging cybersecurity threats.

companyName: TOYOTA MOTOR CREDIT CORP


text: Infrastructure security, including monitoring Goldman Sachs' network for known vulnerabilities and signs of unauthorized attempts to access the firm's data and systems; Mobile security, including mobile applications; Data security, including cryptography and encryption, database security, data erasure and media disposal; Cloud computing, including governance and security of cloud applications, and software-as-a-service data; Onboarding;

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: We have an information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We utilize third-party information technology services help identify, measure, and prioritize cybersecurity and technology risks, as well as to develop related security controls and safeguards.

companyName: SeaStar Medical Holding Corp

ticker: ICU


text: On an annual basis, the CISO reviews the information security program achievements and reports with the Company's IS Executive Committee, which is a cross-functional group composed of the CEO, the CFO, the CLO, and other executive leaders of the Company. Among other things, the IS Executive Committee approves the Company's Information Security Policy and the allocation of budget and resources to information security program initiatives, performs the annual management review of the information security program, and reviews corrective actions to improve the program.

companyName: LivaNova PLC

ticker: LIVN


text: Oversight for this program is provided by the Audit Committee of the Board. Each quarter our executive officers review matters, including any cybersecurity matters, that may present material risks to our strategy, mission or objectives, and where appropriate, engage third parties to conduct assessments of the risks and gaps that require attention. Risk events are classified based on the evaluated likelihood of the risk materializing and its potential impact on the enterprise, and for each material risk a definitive risk mitigation strategy is developed, executed, and shared with the Audit Committee and the Board by our Chief Legal Officer and Corporate Secretary, working closely with our Chief Financial Officer and Director of IT, at least quarterly to ensure appropriate monitoring and management of the relevant risks. To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.

companyName: Anterix Inc.

ticker: ATEX


text: Identify We establish an understanding of our critical operational assets and those that could be attractive to potential threat actors. We consider any cyber activity that could diminish an asset's value, hinder our ability to use or access the asset, or covertly allow a threat actor to gain access to an asset as a potential risk.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: the deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities; and consideration of the cybersecurity risks posed by interacting with current and potential third-party service providers, suppliers and customers.

companyName: MedWellAI, Inc.

ticker: MWAI


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident during the year ended December 31, 2024, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: The Company's Third-Party Risk Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Board's Oversight of Cybersecurity Risk To ensure thorough oversight of the Company's cybersecurity policies and processes, the Audit Committee is responsible for overseeing our cybersecurity risk and, pursuant to its charter, establishes and oversees procedures for the Company's plans to mitigate cybersecurity risks and respond to data breaches. The Audit Committee receives regular reports from the CISO on the Company's cybersecurity risks and enterprise cybersecurity program. The Audit Committee also receives prompt information and periodic updates by the CISO regarding material cybersecurity incidents that meet reporting thresholds. The Audit Committee reports out to the Board as necessary to keep the Board informed of issues or risks relating to the Company's cybersecurity.

companyName: MGM Resorts International

ticker: MGM


text: The Board's Oversight of Cybersecurity Risk The Board recognizes the critical importance of maintaining the trust and confidence of our clients, business partners and employees. The Board is actively involved in oversight of the Company's ERRF, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Board is responsible for overseeing the Company's risk management processes over the short-, medium- and long-term by staying informed of the Company's material risks and evaluating whether management has reasonable controls in place to address such material risks. As part of its oversight responsibilities, the Board dedicates meaningful time and attention to oversight of cybersecurity risk. The Board is not responsible, however, for defining or managing the Company's various risks. See "Management's Involvement in Cybersecurity Risk Oversight" below.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our corporate security and information security programs are designed to help us prevent, prepare for, detect, respond to and recover from cybersecurity threats. We leverage industry standard security frameworks to evaluate our security controls. Relevant personnel collaborate with subject matter experts throughout the process to identify and assess material cybersecurity threats, evaluate their severity, and explore ways to mitigate a potential security incident. We continually conduct security and privacy reviews to pinpoint risks associated with our products, services and enterprise. We also employ various monitoring tools to track suspicious or anomalous activity across our networks, systems, and data, and we simulate cyber threats to proactively address vulnerabilities. Finally, we routinely train our employees on cybersecurity matters.

companyName: ORACLE CORP

ticker: ORCL


text: Administered by information security, information technology, and compliance professionals and managed by senior management at each of our subsidiaries, our cybersecurity program is integrated into our broader enterprise risk management process and aligns with recognized frameworks and industry standards, as applicable, and complies with various legal and regulatory requirements.

companyName: ARGAN INC

ticker: AGX


text: We have an Information Security Management Steering Committee ("ISMS Committee"), comprised of our Chief Information Security Officer ("CISO"), as well as members of our executive team, including our Chief Information Office and Chief Legal Officer. Our Chief Information Officer and CISO, in coordination with the ISMS Committee, work collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our InfoSec team communicates with and reports to the CISO, enabling the CISO, Cyber Incident Response Team and ISMS Committee to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO has significant experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Hilton has adopted a Cybersecurity Policy that requires all employees to immediately report a potential cybersecurity incident to the GIS team, and all employees are required to certify their understanding of the Cybersecurity Policy on an annual basis. Our Global Cybersecurity Incident Response Plan ("CIRP") includes the criteria for determining if a cybersecurity incident is considered a qualifying cybersecurity incident ("QCI"), which requires management escalation and review, identifies the first response team and the leadership team responsible for supervising the response and provides guidelines for when and how to communicate such incident to the appropriate members of management and the Audit Committee.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: The Board of Directors' oversight function includes cybersecurity risk management. The Board of Directors has three members with skills and experience in information security and cybersecurity through their experience as current and former executives of digital technology companies.

companyName: OptimizeRx Corp

ticker: OPRX


text: We continuously monitor and assess our cybersecurity posture to adapt to evolving threats and technologies. We conduct periodic reviews and assessments of our cybersecurity posture to identify gaps and implement enhancements to strengthen our defenses.

companyName: GSE SYSTEMS INC


text: The Company leverages multiple channels to promote cybersecurity topics, deliver targeted initial and refresher training for all users, and conduct an annual mandatory global information security training campaign with certification, which is translated into 20 languages, and ongoing awareness campaigns. These elements are designed to maintain a risk aware culture.

companyName: Johnson Controls International plc

ticker: JCI


text: NeurAxis routinely reviews the Office of Civil Right (OCR) audit requirements to assess any gaps within our cybersecurity, privacy and security programs. We have not identified risks from known cybersecurity threats, that have materially affected us, including our operations, business strategy, results of operations, cash flows or financial condition. We face certain ongoing risks from cybersecurity threats, including active interactions with children's hospitals while assisting with insurance prior approvals, that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, cash flows or financial condition.

companyName: Neuraxis, INC

ticker: NRXS


text: Through these processes, during our fiscal year 2024 and through the date of this filing we did not identify risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the section titled "Item 1A. Risk Factors – Business and Operational Risk Factors - We have in the past experienced and in the future could experience unauthorized access into our information systems."

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Our cybersecurity risk management is part of our broader enterprise risk management process, which is managed by our internal audit team with oversight from our executive leadership, and ultimately, the Audit Committee and the Board. Supported by a global team of information security professionals, we have in place a variety of tools, processes and services designed to identify the impacts of changing cybersecurity threats within our IT networks and systems and those networks and systems managed by key vendors or third parties. Cybersecurity risks are identified, quantified and mitigated by leveraging detection and preventive technologies, including security monitoring, intrusion detection and prevention systems, routine risk assessments, a vulnerability management infrastructure and a global incident response program. In addition, we also periodically consult with outside advisors and experts on security controls of our products and manufacturing sites and to anticipate future trends, such as threats and issues within the healthcare industry as well as updates on key regulatory changes, including evolving cybersecurity policies and mandates from the FDA and the Cybersecurity and Infrastructure Security Agency. Components of our cybersecurity program are also evaluated by third parties such as our customers, external auditors and government agencies.

companyName: QuidelOrtho Corp

ticker: QDEL


text: To that end, we have robust cybersecurity risk management processes that include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and services and management oversight to assess, monitor, identify, detect and manage risks from cybersecurity threats, and to respond to, conduct forensic analysis of, escalate appropriately and report cybersecurity incidents. We proactively obtain intelligence about potential cybersecurity threats, hunt for cybersecurity threats and consistently work to enhance our cybersecurity operations.

companyName: Sylvamo Corp

ticker: SLVM


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Committee as needed, but no less frequently than annually. On at least a quarterly basis, management and the Information Security Committee report to our Board of Directors on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks that are material to us.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: The Company has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO