text: Our Vice President of Information Security is responsible for overseeing the Company's cybersecurity practices. He joined the Company in 2018 and has over 10 years of information security and cybersecurity experience. He has the relevant education and professional security certifications and trainings, including the Certified Information Systems Security Professional certification. In his role as Vice President of Information Security, he meets with the Audit and Compliance Committee and Board of Directors each quarter to discuss the Company's cybersecurity risk management program.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Our business depends on our continued ability to collect and safeguard vast amounts of personal and sensitive business information, including, among other types of data, protected health information (PHI), employee information, credit card information, insurance information, proprietary and confidential information about our business, financial information, trade secrets, intellectual property, and the sensitive and confidential information from the third parties with whom we work. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and hardware and software, to safeguard and prevent unauthorized access to this critical data (collectively Information Systems and Data).

companyName: Tempus AI, Inc.

ticker: TEM

secItem: Item 1C


text: Our Board of Directors considers cybersecurity risks through interaction with our management team and the Audit Committee, as well as through quarterly updates with our CISO.

companyName: FIVE BELOW, INC

ticker: FIVE


text: We continually monitor our information system in order to detect anomalous activity and verify the effectiveness of our protective measures. In connection with this phase, we do the following: • Run extended detection and response software on our network at all times, which is comprehensive company-wide personal computer device security monitoring and active threat remediation software that is fully supported by staff and backed by a prevention warranty; • Engage third-party specialists to periodically perform: (i) penetration testing, which is a simulated cyberattack against our computer system, in order to assess our ability to resist potential threats and attacks from external and internal sources; (ii) cyber dwelling, which determines if a threat actor has made its way or could make its way into our computer network and if confidential information was or could be compromised; and (iii) tabletop mock cybersecurity incident exercises to gauge our ability to react to an attack; • Evaluate the technical control structure and competency for all new third-party software vendors and review "cloud" third-party software vendor's Service Organization Control reports, or reasonable substitutes, which give comfort on the maturity of the vendor's security controls; and • Perform monthly mock phishing email exercises with our employees and provide additional training if needed.

companyName: FIRST INDUSTRIAL LP


text: We perform technical assessments with feedback incorporated into our systems and procedures through continual upgrades intended to further improve our cybersecurity posture.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners, and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security manages the Company's cybersecurity efforts and leads the cybersecurity team under the direct oversight of our Chief Technology Officer. These individuals, including all members of the cybersecurity team, have an average of over 16 years of experience involving information technology, including security, auditing, compliance, systems, and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation, and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: On a regular basis, the head of administration reports to our Board of Directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.

companyName: Alaunos Therapeutics, Inc.

ticker: TCRT


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: The Audit Committee of the Board of Directors has assumed responsibility for the oversight of management's strategies and processes for addressing risks from cybersecurity threats. The Audit Committee or the full Board receives quarterly updates regarding cybersecurity and data privacy matters from senior management, including leaders from the Information Technology and Legal teams. This generally includes briefings regarding existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), a cybersecurity maturity scorecard, status of key information security initiatives, and significant developments in data privacy regulations.

companyName: MOVADO GROUP INC

ticker: MOV


text: At the Company, we expect each associate to be responsible for the security and confidentiality of customer information. We communicate this responsibility to associates during on-boarding and throughout their employment. Annually, training courses are assigned to each associate to complete on how to protect the confidentiality of customer information at the time of hire and during each year of employment.

companyName: FIRST BANCSHARES INC /MS/


text: In addition, Mr. Tao graduated with a Bachelor of Science degree from Beijing Institute of Technology and holds an MBA from Beijing University of Posts and Telecommunications. This combination of education in computer science and business management allows Mr. Tao to oversee our cybersecurity governance.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Our policies and processes also address cybersecurity threat risks associated with our use of third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our data to ensure they have adequate cybersecurity safeguards in place and continually monitor cybersecurity threat risks identified through such diligence.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Cybersecurity incidents continue to become more prevalent requiring adequate and and continuous assessment, identification, and management of material risks associated with cybersecurity threats. These risks include, among other things, disruption of our business processes and proprietary software, and potential unwanted disclosure of protected personal information which may cause harm to our employees, and clients, violations of privacy laws and regulations, breach of confidentiality and other contractual obligations, litigation and legal action, and financial and reputational harm. We utilize cybersecurity technologies and established procedures and processes to identify, assess, and manage these material cybersecurity risks.

companyName: HireQuest, Inc.

ticker: HQI


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K under the heading "Cybersecurity and Data Risks."

companyName: Surgery Partners, Inc.

ticker: SGRY


text: We rely on the proper functioning and availability of our information technology systems, some of which are dependent on services provided by third parties, in operating our business. It is important that the data processed by these systems remains confidential, as it often includes sensitive information relating to our business, customers, employees, and vendors. Consequently, we are focused on mitigating cybersecurity risks. Trinity has an information risk management ("IRM") organization headed by an experienced Chief Information Security Officer ("CISO"), which is separate from our broader information technology organization.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Our CISO reports to our Vice President of Platform and Technology Services, who has over two decades of technology leadership experience and has earned a relevant degree. Our VP of Platform and Technology Services leads the teams responsible for the Company's core technology platforms. Prior to joining Paychex in October 2012, he held senior technology leadership positions at two telecommunications companies.

companyName: PAYCHEX INC

ticker: PAYX


text: Our Audit Committee discusses risks related to cybersecurity quarterly, and reports to the Board quarterly on such risks and events. Our Senior Director of Information Systems presents information to the Audit Committee regarding cybersecurity risks and events quarterly. The full Board also discusses cybersecurity risks and events annually. If there are direct risks rising to the level of potential materiality, the management team reports such risks and events to the Board.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Although in the last three fiscal years we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including financial losses, penalties, and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. We have described whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in the risk factors titled " Quipt's business depends on its information systems, including software licensed from or hosted by third parties, and any failure or significant disruption or effective cyber-attack on any of these systems, security breaches or improper disclosure of or loss of data could materially affect our business, results of operations and financial condition. " and " Quipt currently outsources, and from time to time in the future may outsource, a portion of its internal business functions to third-party providers, which has significant risks, and Quipt's failure to manage these risks successfully could materially adversely affect its business, results of operations, and financial condition." in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.

companyName: CONTINENTAL RESOURCES, INC


text: The Board is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance, and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: We rely on third-party services for penetration testing, security incident monitoring, managing our enterprise-wide cybersecurity processes, incident response preparation, end point protection, and security awareness online training.

companyName: Cronos Group Inc.

ticker: CRON


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain policies to ensure our systems are effective and prepared for information security risks. For example, our PharmaCyte Information Security Policy, which applies to all employees, contractors and third parties granted access to our systems and provides guidelines for maintaining information security, including safeguarding personal and company-issued digital devices, learning to detect phishing and other attacks, restricting data transfer, and ensuring the judicious use of the internet and social media. We also maintain a more general Risk Management Strategy that sets forth our procedures for identifying, assessing, responding to, monitoring, and reporting risks, including any cyber-related risks.

companyName: PharmaCyte Biotech, Inc.

ticker: PMCB


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and Cybersecurity Maturity Model Certifications ("CMMC"), as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.

companyName: Woodward, Inc.

ticker: WWD


text: As a company selling products, including those for defense applications, we may be the target of cyber-attacks from a variety of threat actors. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure. Our Cybersecurity Program.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: Information security and privacy are an important part of our culture and are foundational to our goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: The Company has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Company's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Company's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR ENERGY INC

ticker: CVI


text: We incorporate cybersecurity into our Enterprise Risk Management program. Our cybersecurity program incorporates cybersecurity processes, technologies, and controls designed to identify and manage potential material cyber risks including, but not limited to, operational risk, intellectual property theft, fraud, harm to employees, patients, or third parties, and violation of privacy or security-related laws or regulations. Our cybersecurity program is designed to be aligned with applicable industry standards set by the Center for Internet Security. Our cybersecurity program employs a range of tools and services, including regular network and endpoint monitoring, managed detection and response, system patching, managed security services, server and endpoint scheduled backups, awareness training and testing, periodic vulnerability assessment and penetration testing, to update our ongoing risk identification and mitigation efforts and is assessed periodically by independent third parties.

companyName: Celularity Inc

ticker: CELU


text: Depending on the environment, we implement and maintain various technical, physical and administrative processes, measures, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, among other things, incident detection and response plan and procedures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, cryptography, network security controls, secured remote access, access controls, change management, physical security, asset management, secured software development lifecycle, logging and monitoring, third-party risk management programs, security awareness trainings, third-party- and company penetration testing, cybersecurity insurance and dedicated cybersecurity staff. We use our own software to help further mitigate the risk of a material cybersecurity incident. In addition, our Varonis Data Security Platform is deployed internally as part of our insider threat, data security posture, security operations and compliance management programs.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: We implement and maintain a formal information security management program designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, services, and data. Our information security management program includes a dedicated security team led by our Head of Security that is responsible for implementing security controls and monitoring for suspicious activity. Our information security management program also includes a cybersecurity risk management process which aims to identify and assess material risks from cybersecurity threats, including from vulnerabilities within Asana systems and new and emerging threats to Company operations by using automated and manual tools, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, and conducting audits and threat assessments.

companyName: Asana, Inc.

ticker: ASAN


text: The Board oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Board receives regular reports from our Director of Technology Services on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Vice President and Head of Information Technology who reports to our Chief Operating Officer, to manage the risk assessment and mitigation process.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: Our Board of Directors is responsible for our cyber risk oversight, as part of our risk management framework. Our management, primarily through our Chief Technology Officer, provides updates to the Board on a quarterly basis and otherwise as may be needed regarding material matters with respect to cyber risk assessment and overall status regarding our IT systems and controls, including cybersecurity threats during the previous quarter and risks from such threats, strategies and recommendations to mitigate risk from such threats, cybersecurity incidents that have occurred, industry updates, and policy and process recommendations. Our management also coordinates with our IT department to help ensure that cyber risks are integrated into our overall risk identification, management and mitigation strategies, subject to our Board's guidance. As described above, our Chief Technology Officer works with our IT Steering Committee and other members of senior management, including our staff, in assessing the materiality of a cyber risk after a preliminary assessment by our IT department. If a cyber risk is material, our Chief Technology Officer will bring such risk to our Board's attention.

companyName: MFA FINANCIAL, INC.

ticker: MFA


text: At the management level, the SDIT and his team are responsible for leading enterprise-wide information security strategy, policy, standards, architecture and processes, including the assessment and management of material risks from cybersecurity threats. The Company's SDIT reports to the Chief Financial Officer. The SDIT has extensive cybersecurity knowledge and skills, gained from over 25 years of relevant work experience. The SDIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with the CIRP and policies and procedures, which may include reports from the IT team. The SDIT also regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.

companyName: Valaris Ltd

ticker: VAL


text: Because we are aware of the risks associated with third-party service providers, Graphjet Technology will implement stringent processes to oversee and manage these risks. We will conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: GRAPHJET TECHNOLOGY

ticker: GTIJF


text: We recognize the importance of protecting consumer and employee data and maintaining the safety and security of our information systems. We identify, assess and manage material risks on an enterprise basis through our global enterprise risk management ("ERM") program. We maintain a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats, which is aligned to and informed by our ERM program. Our cybersecurity program takes into consideration, among other things, compliance requirements, risks to our revenue channels, risks posed by third-party engagements, consumer and employee data security and global enterprise security. We engage independent third parties to conduct regular penetration testing and targeted security audits of our information systems. In addition, we engage a third-party vendor to conduct 24/7 monitoring of cybersecurity alerts. In the event we identify or are notified of a potential cybersecurity, privacy or other data security incident, we have a data incident response plan that defines procedures for responding to such incidents, including when and how to engage with our executive leadership team, our Board of Directors, other stakeholders and law enforcement, as applicable. We also maintain cyber liability insurance to help defray any financial losses arising out of a cyber security incident; our insurance, however, may not cover all types of cybersecurity incidents or all losses that we incur.

companyName: Under Armour, Inc.

ticker: UAA


text: We face a number of cybersecurity risks in connection with our business. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- Risk Factors.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Equinix has processes for assessing, identifying, and managing material risks from cybersecurity threats, both integrated into our Governance, Risk and Compliance Program (the "GRC Program") and existing within our Information Security function ("InfoSec") led by our Chief Information Security Officer ("CISO").

companyName: EQUINIX INC

ticker: EQIX


text: We are establishing incident response, business continuity, and disaster recovery plans designed to more formally address our response to a cybersecurity incident.

companyName: ZYNEX INC

ticker: ZYXIQ


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;

companyName: Quantum-Si Inc

ticker: QSI


text: Cybersecurity Risk Management Processes Our approach to managing cybersecurity risks is proactive and comprehensive. We employ a range of methods to assess, identify and manage the risk of potential cybersecurity threats, including regular security audits, utilization of a third party service provider for security measures over our virtual environment, threat intelligence monitoring, and vulnerability assessments. Our risk management framework is designed to mitigate potential cyber risks through a blend of technological safeguards, employee training programs, and incident response protocols.

companyName: INNOVATE Corp.

ticker: VATE


text: In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment. We have retained VeraSafe, LLC ("VeraSafe") to help review and monitor our practices and processes related to personal data and compliance with applicable data protection laws. VeraSafe acts as our Data Protection Officer pursuant to the European Union and United Kingdom General Data Protection Regulation and has served in this capacity since May 2021.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee that meets quarterly before board meetings. The Board of Directors oversees cybersecurity and technology risks through the Audit Committee, which receives quarterly updates from the CISO. Intermittent updates are provided to the full Board for educational purposes or when special needs arise.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: As a vertically integrated self-hosted and self-mining Bitcoin miner, the stability and security of GRIID's operating environment, the protection of our intellectual property, and the integrity and cybersecurity practices of strategic third parties are critical. GRIID's information security program is designed to detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. To protect our systems from cybersecurity threats, we use various security tools that help prevent, escalate, investigate, and recover from identified vulnerabilities and security incidents in a timely manner. We also maintain a third-party risk management program to identify, prioritize, assess, mitigate, and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk and cannot guarantee their efforts will be successful in all circumstances.

companyName: GRIID Infrastructure Inc.


text: The SLA services provided by Hawaiian Electric are mainly for applications and systems on Hawaiian Electric's infrastructure, networks and servers. The SLA does not cover support for certain software applications that were procured outside of Hawaiian Electric's procurement and IT policies and procedures. These include the HEI's general ledger application itself, excluding the infrastructure that the general ledger application is installed on, and certain cloud-based software. Although these applications are not supported by Hawaiian Electric, security measures and internal control procedures related to user access and periodic security reviews have been implemented on these applications and are performed on an on-going basis in accordance with Hawaiian Electric's IT policies and procedures. These controls are required to protect HEI's financial and other sensitive information, as well as to prevent cybersecurity breaches on Hawaiian Electric's infrastructure, networks and servers. In the event of a cybersecurity breach on these applications not supported by Hawaiian Electric, HEI employs third party cybersecurity consultants to assess and resolve issues resulting from a breach, depending on its severity. Hawaiian Electric may also provide guidance and support to assist HEI in assessing and resolving cybersecurity breaches. HEI has also formulated disaster recovery plans, which are updated on an annual basis, involving all of its applications, including those applications not supported by Hawaiian Electric.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our management team supervises cybersecurity risk management efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Lite Strategy, Inc.

ticker: LITS


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Information Security Officer (CISO), is responsible for oversight of our Cybersecurity Program, and maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Cybersecurity Program is further supported by our cybersecurity governance, risk and compliance team, which is led by our CISO, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our CISO has over 24 years of experience in cybersecurity, business leadership, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.

companyName: Oportun Financial Corp

ticker: OPRT


text: In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Natics Corp.

ticker: NTCS


text: The Board's Roles and Responsibilities The Board of Directors, as a whole and at the subcommittee level, oversees and monitors our cybersecurity risk, receiving regular updates from management on the status of our current cybersecurity risks, a prioritization of key risk areas to be mitigated, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Third Harmonic Bio, Inc.


text: Engagement of Third Parties on Risk Management We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Palladyne AI Corp.

ticker: PDYN


text: Additionally, in connection with our cybersecurity risk management processes, from time to time, we engage independent third parties to assess our cybersecurity program and to assist us with defining our cybersecurity strategy, uplifting our processes and aligning our objectives. Outside counsel has also advised the Board about legal obligations in managing cybersecurity issues and risks.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: Risks and Incidents The Company faces various cybersecurity risks and threats that could potentially affect its operations, reputation, financial condition, and competitive position. These risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our data, systems, or networks; denial of service attacks; malware infections; phishing or social engineering attacks; ransomware attacks; loss or theft of devices or media containing our data; human error or negligence; natural disasters; power outages; or sabotage. Our data and systems may also be subject to cybersecurity breaches or incidents at its CROs, vendors, partners, or other third parties that we interact with or rely on.

companyName: Mitesco, Inc.

ticker: MITI


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures and process execution, including incident detection, investigation, analysis and response, eradication and recovery.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal and third-party assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: We also have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool. These standards are aligned to the National Institute of Standards and Technology ("NIST"), International Organization for Standardization, Center for Internet Security, and experts are engaged by us to evaluate the integrity of our information systems, as such term is defined in Item 106(a) of Regulation S-K.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Our Board is actively involved in overseeing risks from cybersecurity threats. At least once a year, our Board discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Our Audit Committee has the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies.

companyName: Expion360 Inc.

ticker: XPON


text: In addition, the AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Security Officer (CISO), our frontline business leader with regard to cybersecurity risk management. AAM's CISO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.

companyName: Dauch Corp

ticker: DCH


text: Annually, the Company completes a National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") maturity assessment to identify and evaluate the areas of strength and opportunities for improvement. These maturity assessments, which are performed leveraging independent third-party advisors or through self-assessments, evaluate the organization's cyber maturity based on predefined standards and criteria (e.g., NIST Special Publication (SP) 800-66). Results of these assessments commonly set the roadmap for future cybersecurity improvement initiatives.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of Information Technology and Information Security Officer, General Counsel, CFO and/or Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.

companyName: GENTEX CORP

ticker: GNTX


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: OmniAb, Inc.

ticker: OABIW


text: Reporting to Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CIO provides the Audit Committee and the senior executive management team of the Company information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of Internal Audit also meets with our executive management team and the Audit Committee on a quarterly basis and reports on processes and activities, including applicable cyber risk management, pertinent to enterprise risk management.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Our information security function, overseen by our Vice President of IT and Facilities ("VP of IT and Facilities") and supported by members of our IT, Legal and Finance departments, and our third-party IT service providers, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: using manual and automated monitoring tools; subscribing to reports and services that identify cybersecurity threats; conducting scans of our threat environment; evaluating threats reported to us; conducting internal and external audits for certain data and systems; conducting threat assessments for internal and external threats; conducting vulnerability assessments to identify vulnerabilities; penetration testing; and having third parties conduct threat assessments.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our CFO, who oversees our information security team and has over 2 years of experience overseeing such function.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: External Assessments The Company's Information Technology and Information Security Departments are examined annually by our financial institution regulator, which includes reviewing our cyber risk management activities to ensure we are properly and adequately managing our risks appropriate to the size and complexity of our business and operations. In addition to annual examinations, the Company's Information Security Program, policies and practices, and cyber posture are subject to regular external independent reviews including annual audits, annual penetration tests, and quarterly third-party cyber risk assessments to ensure cybersecurity controls are adequately designed and are operating effectively.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Material Cybersecurity Incidents. While we have experienced several security incidents in the past, we have not experienced any material cybersecurity incidents for the fiscal year ended December 31, 2024. We do not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations or financial condition.

companyName: OneSpan Inc.

ticker: OSPN


text: Every quarter we evaluate our cybersecurity posture and reassess whether significant changes in our business could impact our digital infrastructure. These assessments aim to identify potential internal and external threats, estimate their probability and possible impact, and gauge the effectiveness of our current policies and processes in mitigating these threats.

companyName: Revolve Group, Inc.

ticker: RVLV


text: The Company faces risks from cybersecurity incidents that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Cybersecurity incidents may target and compromise our systems, as well as confidential consumer, employer, and agent information that we store and manage in connection with some of our services. Any cybersecurity incidents affecting our computer networks, databases, third-party services or facilities could lead to potential interruptions of our operations or our ability to manage and report our operating results. Cybersecurity incidents may also result in the inappropriate use or disclosure of personal information, which could adversely affect consumers' confidence in our or our agents' or digital partners' business and expose us to liabilities. As a result, we are required to expend significant capital and other resources to protect us against these security breaches or to alleviate problems caused by these breaches. Intermex has experienced, and may continue to experience, cybersecurity threats in the normal course of its business. To date, however, these events have not had a material adverse effect on the Company's business, financial condition, results of operations, cash flows or reputation. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.

companyName: International Money Express, Inc.

ticker: IMXI


text: To date, management has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Nordson Corporation, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors, Increased information technology threats and cybersecurity incidents and threats could pose a risk to our systems, networks, products, solutions and services and those of our business partners." above for more information. While we are committed to safeguarding our information and the proprietary and confidential information they contain, we note that no security measures can guarantee complete protection against cybersecurity incidents.

companyName: NORDSON CORP

ticker: NDSN


text: A cross-functional management team, which includes members of our information security, technical infrastructure, engineering and legal departments, is responsible for identifying, assessing and managing the risks from cybersecurity threats that are relevant to our business (and, depending on a threat's potential nature and severity, reporting such information to our Audit Committee). This team has primary responsibility for our cybersecurity risk management program, including our cyber and data security incident response plan, supervises our internal personnel and third-party service providers and communicates our cybersecurity risk management processes to senior management, as well as to our Board and Audit Committee. This team reports to our Chief Technology Officer, who has more than 25 years of experience in the technology sector, and possesses more than 75 years of combined experience in cybersecurity matters, including threat assessment and detection, mitigation technologies, incident response, cyber forensics and regulatory compliance. In addition to relevant educational and industry experience, members of this team, including the heads of our information security and technical infrastructure departments, also hold relevant cyber and information security certifications, including from ISACA (Certified Information Security Manager (CISM) and Certified Information Systems Auditor (CISA)) and ISC2 (Certified Information Systems Security Professional (CSSP)). This team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including, as appropriate, the operation of our cyber and data security incident response plan, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including our third-party service providers, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Vivid Seats Inc.

ticker: SEAT


text: Our CISO and CIDO regularly update the Audit Committee on the Company's cybersecurity programs, policies, and practices as warranted, including review of the state of the Company's cybersecurity programs and risks, emerging cybersecurity developments, threats and vulnerability, and the Company's strategy and key cybersecurity initiatives designed to improve the Company's risk posture. In addition, we have an escalation process in place to inform senior management and the Board of material cyber-related issues. The Audit Committee also reviews with our CIDO, on an annual basis, our global information technology structure and strategic efforts to protect, optimize, and support the growth of the Company. The Chair of the Audit Committee reports to the full Board on its activities.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our General Counsel and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.

companyName: Origin Materials, Inc.

ticker: ORGN


text: As disclosed above, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. However, any failure in, or unauthorized access to, our information systems, as such term is defined in Item 106(a) of Regulation S-K, could disrupt our business, result in unintentional disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses, and have a material adverse effect on our business, financial condition, results of operations and prospects. Failures, interruptions, or data breaches involving our information systems, or the information systems of our vendors, could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations and prospects.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. The Company manages cybersecurity and data protection through a continuously evolving program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying, and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our Company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, and implementing cybersecurity countermeasures and mitigation strategies and informing management and the board of directors of material cybersecurity threats and incidents.

companyName: Enlightify Inc.

ticker: ENFY


text: Our board of directors, also acting as our audit committee, is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our CEO is responsible for assessing and managing our material risks from cybersecurity threats and conducts this assessment on a regular basis, or at least once per year.

companyName: Qrons Inc.

ticker: QRON


text: ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN's brands align to the Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services.

companyName: ASGN Inc

ticker: ASGN


text: The Audit Committee receives briefings from the CISO related to ongoing cybersecurity-related initiatives and cybersecurity risks, including emerging threats, at least quarterly. The Audit Committee then determines whether any such matters need to be presented to the full Board. Additionally, the Audit Committee regularly reviews and discusses with management, no less than annually, the Company's enterprise risk assessment and key enterprise risks in connection with the larger ERM program, which includes matters related to information security and technology risks, including cybersecurity. The CISO also provides an update directly to the full Board no less than annually regarding the overall health of the cybersecurity program.

companyName: Walgreens Boots Alliance, Inc.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes, and practices are being integrated into the Company's enterprise risk management program and are based on recognized frameworks and other applicable industry standards, including without limitation the National Institute of Standards and Technology Cybersecurity Framework 2.0, Center for Internet Security controls and American Institute of Certified Public Accountants framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: FARO TECHNOLOGIES INC


text: The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation ("BNY Mellon"), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2023 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

companyName: VOC Energy Trust

ticker: VOC


text: The Company conducts annual cyber-risk mitigation exercises including awareness outreach, annual IT Security Awareness training, monthly phishing tests, and a variety of ongoing vulnerability scans. Over the past two years, the Company has implemented multiple new security tools designed to provide visibility and controls allowing the cybersecurity team to safeguard data against theft or loss.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: As part of the Company's supplier risk management program, using a risk-based approach, the Cybersecurity team conducts formal risk assessments with respect to certain of the Company's third-party service providers. The assessment process addresses aspects of the service providers' data security controls and policies. The team also conducts reassessments of its third-party risk assessments, the frequency of which is determined based on a risk assessment and rating process. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that includes clear terms involving the collection, use, sharing and retention of user data, as well as compliance with appropriate security terms.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: We believe that the impact of any previously identified cyber incidents, including those subject to ongoing investigation and remediation, will not have a material impact on the Company, including business strategy, results of operations or financial condition.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: Strategic Education, Inc.

ticker: STRA


text: The Company's Board of Directors is responsible for the oversight of management's efforts to address cybersecurity risks. The Board of Directors has designated the Audit Committee with the responsibility of overseeing and reporting to the Board on management's handling of cybersecurity risk management and on the adequacy and effectiveness of the Company's cybersecurity risk management strategy. Management also updates the Board on an on-going basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats. The Company's information security team is led by Dustin Woods, who has over 10 years of experience managing risks and advising on cybersecurity matters.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS"), and align our security program closely to the NIST Cyber Security Framework. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: Management, including the Vice President, Information Systems and Executive Vice President, Global Risk Management, serves on the Company's incident response team to help the Company address cybersecurity incidents. In addition, the Company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee holds quarterly meetings and receives periodic reports from management, including our Chief Financial Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Audit Committee also receives periodic reports from the Company's internal audit team with respect to regular network penetration and related tests to ensure that the Company's defense tools, processes and procedures are operating as designed.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response policy and scenario-based playbooks, an incident detection program, a vulnerability management program, disaster recovery and business continuity plans, risk assessment processes, security standards, network security controls, access controls, systems monitoring, employee awareness training and cyber insurance.

companyName: LEAR CORP

ticker: LEA


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Operational Risks" as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. However, because Southwest Gas' operations involve critical infrastructure, as defined under federal law and by the TSA, we have been and will continue to be the target of cybersecurity attacks from time to time.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: We conduct periodic risk assessments to identify cybersecurity threats. We also conduct likelihood and impact assessments with the goal of identifying reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have not been material.

companyName: Covista Inc.

ticker: CVSA


text: Policies and Procedures for Third-Party Service Providers We do not have specific policies and procedures to oversee, identify, or mitigate the cybersecurity risks associated with our use of third-party service providers, other than relying on SOC 1 Type 2 reports for materially in-scope applications.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Incident and Remediation Summary In May 2025, we detected unauthorized changes to our domain, DNS, and email configurations originating from administrative credentials retained by a former employee. The impact was limited to a brief email-routing disruption; all production systems remained fully operational. Based on internal reviews and independent external assessment, we found no evidence of data exfiltration or compromise involving customer data, financial information, or internal systems, and the issue was contained on the same day it was discovered.

companyName: TREASURE GLOBAL INC

ticker: TGL


text: The CDO has over 30 years of information technology experience, including at several Fortune 500 companies and including experience with cybersecurity initiatives that address governance, operational practices, cyber-awareness and technology. The CISO has over 25 years of cybersecurity and risk management experience, specializing in strategy, architecture, and operational practices at multiple Fortune 500 companies. The CDO holds an undergraduate degree in electrical and electronics engineering, a master's degree in computer science and a master's degree in business administration. The CISO holds an undergraduate degree in political science and a master's degree in information security, along with Certified Information Systems Security Professional (CISSP) and Information Systems Security Management Professional (ISSMP) certifications.

companyName: DOVER Corp

ticker: DOV


text: The Company's current Head of Information Securities has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.

companyName: IMAX CORP

ticker: IMAX


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.

companyName: NEWMARKET CORP

ticker: NEU


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. This education and awareness program functions to educate employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We automatically assign online reinforcement training upon initial phish test failure and may follow-up one-on-one as needed. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual penetration tests conducted by independent, third-party cybersecurity firms and ongoing vulnerability assessments conducted by the internal security team.

companyName: ARVINAS, INC.

ticker: ARVN


text: Our CIO and FVPIS collectively have over eight decades of IT and cybersecurity experience, including five decades in senior-level leadership roles. Our FVPIS spent over three decades in federal law enforcement working in cyber related roles.

companyName: PRICESMART INC

ticker: PSMT


text: Based on the information available as of the date of this Annual Report, no material risks from known cybersecurity incidents have, either individually or in the aggregate, materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. There is no guarantee that any risks from cybersecurity threats will not materially affect us in the future.

companyName: Torrid Holdings Inc.

ticker: CURV


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to continue to refine our cybersecurity strategies and processes.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our cybersecurity program is designed around the MITRE Adversarial Tactics, Techniques and Common Knowledge ("ATT&CK") Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness. Our Director of Technology, Information Security Officer, Chief Operations Officer and key members of their teams collaborate with peer banks and industry groups to review cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: The Bank has a dedicated Information Security Department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk and that handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect the Bank against those risks, responsible for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.

companyName: Federal Home Loan Bank of Atlanta


text: The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program. At least annually, the Director of Technology Solutions and the Chief Risk Officer report to the Risk Committee the overall status of the Information Security Program. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: FIRST OF LONG ISLAND CORP


text: Oversight of Third-Party Providers When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness. Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide a SOC 1 or SOC 2 report and, for vendors unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness. We also include security and privacy addenda in our supplier contracts where applicable. Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A. Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."

companyName: NCR Atleos Corp

ticker: NATL


text: Adient's IT compliance team conducts regular risk assessments and related testing for software applications, networks and other asset vulnerabilities, including cybersecurity. Adient's internal audit function performs an independent risk assessment, including cyber risks, to determine its annual audit plan. The IT management team also conducts cyber maturity self-assessments at least every two years, whereby risk owners are responsible to further assess and remediate, as applicable. Assessment risks are gauged on their potential impact and likelihood. Adient documents and monitors the efficacy of its strategic interventions designed to minimize these risks, ensuring robust and proactive risk management. Separately, Adient applies a risk-based approach for suppliers, by conducting risk reviews, directing surveys, and requiring adherence to its Global Supplier Standards Manual. Adient's third-party risk assessment process is intended to equip leadership with an objective analysis of security risk for more informed decision making and enhanced organizational resilience.

companyName: Adient plc

ticker: ADNT


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and Chief Information Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data, which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information, such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.

companyName: Laird Superfood, Inc.

ticker: LSF


text: We operate our segments and their practices through FTI Consulting and its subsidiaries in 34 countries with different business, client, and geographic cybersecurity risk profiles. We aim to proactively identify and assess our vulnerability to cybersecurity threats and actual cybersecurity incidents on an ongoing basis at both the enterprise level, as well as at a more operational level, differentiating unique risks related to our segments, practices, clients, employees, and the locations in which business is conducted. Our Information Technology Group ("ITG") helps monitor and analyze cybersecurity incidents and risks and our progress mitigating and resolving such threats. This information is regularly discussed with our outside directors and executive management.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, Chief Operating Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it. Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees. Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.

companyName: Cardlytics, Inc.

ticker: CDLX


text: The Audit Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives periodic briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our enterprise risk management committee ("ERMC") and internal information technology security staff as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: Our CISO reports to our Chief Digital and Technology Officer ("CDTO"), an executive officer, who provides management of cybersecurity risks, reviews operational metrics and performs other relevant activities related to the cybersecurity function.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Our general operating procedures for cybersecurity risk management are incorporated into our overall enterprise risk management programs, and share common methodologies, reporting channels and governance processes, including the following:

companyName: INVO Fertility, Inc.

ticker: IVF


text: For additional information regarding how cybersecurity threats have affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see Part I, Item 1A, "Risk Factors—General Risk Factors—Interruption, interference with, or failure of our information technology and communications systems could hurt our ability to effectively provide our products and services, which could harm our reputation, financial condition, operating results and cash flows."

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: To date, the Company has not experienced any cybersecurity incidents that have materially impacted its operations or financial condition. Nevertheless, cybersecurity threats continue to evolve, and the Company has developed and implemented a comprehensive Incident Response Plan to effectively manage cybersecurity incidents. The plan is regularly reviewed, tested, and updated to facilitate its effectiveness in mitigating and responding to cybersecurity threats promptly.

companyName: 8X8 INC /DE/

ticker: EGHT


text: The audit committee is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. The CISO provides reports at least quarterly to the audit committee as well as to our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the audit committee. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our audit committee also receives prompt and timely information regarding cybersecurity threats or incidents that may be material in nature, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain appropriate errors and omissions insurance that provides coverage for such incidents.

companyName: Alteryx, Inc.


text: Our Chief Financial Officer and Chief Compliance Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats and plans and strategies to address threats and incidents.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: However, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our risk factors identified in Item 1A: Risk Factors included elsewhere in this Report provide further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (i) preventing and preparing for cybersecurity incidents, (ii) detecting and analyzing cybersecurity incidents, and (iii) containing, eradicating, recovering from, and reporting cybersecurity events.

companyName: Public Storage

ticker: PSA


text: The Company engages third-party security firms to provide or operate some of these security controls and technology systems. For example, third parties conduct assessments such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: FORMER BL STORES INC

ticker: BIGGQ


text: Our Board has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our and our subsidiaries' management, including our and our subsidiaries' senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: LOEWS CORP

ticker: L


text: The Board of Directors oversees the Policy and its implementation of the Company's oversight, programs, procedures, and policies related to cybersecurity, cybersecurity risks, information security, and data privacy. Departments of the Company have been identified under the Policy to report to the Company's Head of IT overseeing the cybersecurity strategy as defined in the Policy.

companyName: Bit Digital, Inc

ticker: BTBT


text: As of the year ending December 31, 2023, the Company has had no cybersecurity incidents or been at risk from cybersecurity threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Cell Source, Inc.

ticker: CLCS


text: We have significantly increased our cybersecurity investments over the last few years and continue to implement additional cybersecurity safeguards designed to detect and prevent cybersecurity incidents. Notwithstanding our increased cybersecurity investments and preparedness activities, threat actors and cybersecurity incidents still pose a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property, confidential information and personal data. For more information on how a cybersecurity incident may impact the Company, refer to the risk factor titled "Data privacy, cybersecurity, and artificial intelligence considerations could impact our business," in Item 1A of this Form 10-K.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: The ISMS within Littelfuse consists of internationally recognized program elements that reduce the risk of an operational or cybersecurity incident from significantly impacting Littelfuse and its customers, vendors, and employees. These ISMS elements include but are not limited to:

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: We rely on our subsidiary-level information technology professionals to continuously monitor and update our IT networks and infrastructure. Their role is to prevent, detect, address, and mitigate risks related to unauthorized access, misuse, malware, and other security threats. To safeguard our data and business processes, as well as those of our subsidiaries, we invest in industry-standard security technologies to defend against cyber risks.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had a material cybersecurity incidents in fiscal 2025 or 2026 through the date of filing of this Form 10-K.

companyName: PURE CYCLE CORP

ticker: PCYO


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Govern, Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels. These controls and their performance are constantly evaluated and evolved to ensure that the Company remains well protected against any new threats.

companyName: GXO Logistics, Inc.

ticker: GXO


text: Risk management and strategy Northern Trust understands the importance of managing cybersecurity risk to ensure the safety and security of our data, network and systems. Our cybersecurity program is regularly assessed by Audit Services through various assurance activities, with the results reported to the Audit Committee of the Board of Directors (Audit Committee), and by the Non-Financial Risk team, with the results reported to the Business Risk Committee of the Board of Directors (Business Risk Committee). Northern Trust also operates a global security operations center for threat identification and response. The center aggregates security threat information from systems and platforms across the business and alerts the organization in accordance with its documented Cybersecurity Incident Response Plan. In addition to the cybersecurity controls managed and monitored within the organization, Northern Trust uses external third-party security teams on a regular basis to assess the effectiveness of our cybersecurity program and controls. These teams perform program maturity assessments, penetration tests, security assessments, and reviews of Northern Trust's vulnerability to cyber-attacks. Annually, certain elements of the cybersecurity program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the Board. Our cybersecurity program is also examined regularly by the Corporation's prudential and conduct regulators within the scope of their jurisdiction.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Our Chief Technology Officer ("CTO"), Director of IT (Information Technology), and Vice President of Platform Engineering (collectively, the "Security Team") have primary responsibility for assessing and managing cybersecurity risks. The Security Team reviews security performance metrics, identifies security risks, and assesses the status of approved security enhancements. The Security Team also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.

companyName: VirnetX Holding Corp

ticker: VHC


text: The board of directors receives periodic reports from the Enterprise Risk Management Committee and the Vice President of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Poseida Therapeutics, Inc.


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board of Directors, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impacts from cybersecurity threats and incidents, escalating to management and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: We recognize the importance to our business and reputation of the continuous availability of our internal and client-facing information technology systems, as well as our ability to protect both the confidential information of our clients and our own intellectual property and business information. We are committed to protecting our client and business data and information technology assets and have implemented a cybersecurity program with policies, standards, processes and practices governing the protection and control of information during its lifecycle of creation, usage, transmission, storage and disposal.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Eventbrite, Inc.

ticker: EB


text: Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the management agreement between us and our Manager, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA information and security team, including the ORIX USA CIO, to provide us with a comprehensive cybersecurity risk management program.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL